Merge pull request #5476 from koba1t/pinToCmdConfig

Update cmd/config to v0.13.0

.github/dependabot.yml

@@ -4,3 +4,11 @@ updates:
   directory: "/"
   schedule:
       interval: "weekly"
+
+- package-ecosystem: gomod
+  directory: "/"
+  schedule:
+    interval: "weekly"
+  open-pull-requests-limit: 10
+  vulnerability-alerts:
+    enabled: true

.github/workflows/apidiff.yml

@@ -0,0 +1,36 @@
+name: APIDiff
+
+# Trigger the workflow on pull requests and direct pushes to any branch
+on:
+  push:
+  pull_request:
+
+jobs:
+  go-apidiff:
+    name: Verify API differences
+    runs-on: ubuntu-latest
+    # Pull requests from different repository only trigger this checks
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Setup Go
+        uses: actions/setup-go@v4
+        with:
+          go-version-file: go.work
+      - name: Execute go-apidiff
+        uses: joelanford/go-apidiff@v0.7.0
+        with:
+          compare-imports: true
+          print-compatible: true
+      - name: Report failure
+        uses: nashmaniac/create-issue-action@v1.2
+        # Only report failures of pushes (PRs have are visible through the Checks section) to the default branch
+        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/master'
+        with:
+          title: 🐛 go-apidiff failed for ${{ github.sha }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          labels: kind/bug
+          body: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

.github/workflows/go.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: [ubuntu-latest]
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         fetch-depth: 0
     - name: Set up Go 1.x
@@ -33,7 +33,7 @@ jobs:
     runs-on: [ubuntu-latest]
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Set up Go 1.x
       uses: actions/setup-go@v3
       with:
@@ -49,7 +49,7 @@ jobs:
     runs-on: [macos-latest]
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Set up Go 1.x
       uses: actions/setup-go@v3
       with:
@@ -65,7 +65,7 @@ jobs:
     runs-on: [windows-latest]
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Set up Go 1.x
       uses: actions/setup-go@v3
       with:

.github/workflows/release.yaml

@@ -0,0 +1,27 @@
+name: release
+
+on:
+  push:
+    tags:
+      - kyaml/v*
+      - cmd/config/v*
+      - api/v*
+      - kustomize/v*
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Set up Go 1.x
+      uses: actions/setup-go@v3
+      with:
+        go-version-file: go.work
+      id: go
+    - run: ./releasing/create-release.sh "${tag}"
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        tag: ${{ github.ref_name }}

.golangci.yml

@@ -34,6 +34,7 @@ linters:
     - golint
     - maintidx
     - nosnakecase
+    - testpackage # it's better to keep tests in the same package for now because kustomize does open box testing
 
 linters-settings:
   dupl:

CONTRIBUTING.md

@@ -13,6 +13,7 @@
 [CNCF Code of Conduct]: https://github.com/cncf/foundation/blob/master/code-of-conduct.md
 [Kubernetes Community Membership]: https://github.com/kubernetes/community/blob/master/community-membership.md
 
+[Kustomize Architecture]: ARCHITECTURE.md
 [Contribution Guide]: https://kubectl.docs.kubernetes.io/contributing/kustomize/
 [MacOS Dev Guide]: https://kubectl.docs.kubernetes.io/contributing/kustomize/mac/
 [Windows Dev Guide]: https://kubectl.docs.kubernetes.io/contributing/kustomize/windows/
@@ -25,13 +26,88 @@ _As contributors and maintainers of this project, and in the interest of fosteri
 
 ## Getting Started
 
-Dev guides:
+### Forking Kustomize and Working Locally
+The Kustomize project uses a "Fork and Pull" workflow that is standard to GitHub. In git terms, your personal fork is referred to as the "origin" and the actual project's git repository is called "upstream". To keep your personal branch (origin) up to date with the project (upstream), it must be configured within your local working copy.
 
-- [Contribution Guide]
-- [MacOS Dev Guide]
-- [Windows Dev Guide]
+### Create a fork in GitHub
+1. Visit https://github.com/kubernetes-sigs/kustomize
+2. Click the `Fork` button on the top right
 
-General resources for contributors:
+### Clone the repository
+```bash
+# Clone your repository fork from the previous step
+git clone --recurse-submodules git@github.com:<your github username>/kustomize.git
+cd kustomize
+
+# Configure upstream
+git remote add upstream https://github.com/kubernetes-sigs/kustomize
+git remote set-url --push upstream no_push
+
+# Review git configuration
+git remote -v
+```
+
+### Create a working branch
+```bash
+# Fetch changes from upstream master
+cd kustomize
+git fetch upstream
+git checkout master
+git rebase upstream/master
+
+# Create your working branch
+git checkout -b myfeature
+```
+
+### Sync your working branch
+You will need to periodically fetch changes from the `upstream` repository to keep your working branch in sync.
+```bash
+cd kustomize
+git fetch upstream
+git checkout myfeature
+git rebase upstream/master
+```
+
+### Push to GitHub
+When your changes are ready for review, push your working branch to your fork on GitHub.
+```bash
+cd kustomize
+git push origin myfeature
+```
+
+### Create a Pull Request
+1. Visit your fork at `https://github.com/<user>/kustomize`
+2. Click the **Compare & Pull Request** button next to your `myfeature` branch.
+3. Check out the pull request [process](https://github.com/kubernetes/community/blob/master/contributors/guide/pull-requests.md) for more details and advice.
+
+If you ran `git push` in the previous step, GitHub will return a useful link to create a Pull Request.
+
+
+### Build Kustomize
+The [Kustomize Architecture] document describes the respository organization and the kustomize build process.
+```bash
+# For go version >= 1.13
+unset GOPATH
+unset GO111MODULES
+
+# Build kustomize binary and install in go bin path
+cd kustomize
+make kustomize
+
+# Run unit tests
+make test-unit-all
+
+# Run linter
+make lint
+
+# Test examples against HEAD
+make test-examples-kustomize-against-HEAD
+
+# Run your development version
+~/go/bin/kustomize version
+```
+
+### General resources for contributors
 
 - [Contributor License Agreement] - Kubernetes projects require that you sign a Contributor License Agreement (CLA) before we can accept your pull requests.
 - [Kubernetes Contributor Guide] - Main contributor documentation.
@@ -59,12 +135,144 @@ Kustomize follows the [Kubernetes Community Membership] contributor ladder. Role
 
 The kyaml module within the Kustomize repo has additional owners following the same ladder.
 
-Administrative notes:
+For the kustomize project, we have defined some specific guidelines on each step of the ladder:
+
+To reach reviewer status, you must:
+- Have been actively involved in kustomize for 3+ months
+- Review at least 8 PRs that have been driven through to completion (see the reviewer guide below)
+- Author at least 5 PRs that have been approved and merged
+- Be a member of the kubernetes-sigs org. This should not be a blocker though, as once you meet the requirements for reviewer here,
+the existing kustomize maintainers will be happy to sponsor your request to join the kubernetes-sigs org.
+- Once you have met the above requirements, you may submit a PR adding yourself to the kustomize reviewers list, with links to your
+contributions in the description.
+
+To reach approver status, you must:
+- Meet all the requirements of a reviewer
+- Have been actively involved in kustomize for 6+ months
+- Review at least 15 PRs that have been driven through to completion (see the reviewer guide below)
+- Authored PRs meeting *either* of the following requirements:
+  - 15 PRs that have been approved and merged
+  - *OR* 10 PRs that have been approved and merged where some were more difficult, required greater thought/design,
+or built up to larger features/long-term goals.
+- File 3 issues. This can be any number of things, including but not limited to:
+  - Bugs with kustomize usage that you've found
+  - CI or release improvements
+  - Creating subtasks of a larger feature or project that you are in charge of.
+  - Long term improvements for the health of the project
+- Triage at least 10 untriaged issues, including at least 1 feature request. The kustomize bug scrub is a great place to get practice with doing this, but you can
+also follow the triage guide below to get started on your own.
+- Demonstrate deeper understanding of kustomize goals. This can take many forms and is a bit subjective, but here are a few examples:
+  - saying no to an eschewed feature, instead recommending an alternative solution that is more aligned with the declarative configuration model
+  - active participation in discussion on a feature request issue
+  - filing an issue describing a long term problem and solution aligned with kustomize goals, for example: https://github.com/kubernetes-sigs/kustomize/issues/5140
+  - writing up KEPs for features that will improve the kustomize workflow while being aligned with kustomize goals, for example: https://github.com/kubernetes-sigs/kustomize/pull/4558
+- Regularly interact with the existing kustomize maintainers, with clear communication about what you are working on or planning to work on. The kustomize
+maintainers should know who you are and be familiar with your contributions.
+- If you meet *most* of the above requirements while going above and beyond in a few areas, we will still consider your request to become an approver even
+if you are missing one or two of the requirements. Please contact the maintainers directly to ask about getting approver status if you fall into this category.
+- Otherwise, once you meet all the above requirements, you may:
+  - request to be added to the kustomize maintainer meeting that occurs each week with the kustomize PMs.
+  - submit a PR adding yourself to the kustomize approvers list, with links to your contributions in the description.
+
+To reach owner status, you must:
+- Meet all the requirements of an approver
+- Have been actively involved with kustomize for 1+ year
+- Assisted the current owner in driving the roadmap. This can be explicit or implicit help, such as:
+  - Editing the roadmap directly
+  - Reviewing the roadmap
+  - Providing suggestions for issues or prioritization in meetings that indirectly influence the roadmap
+- Regularly triage issues and attend the kustomize bug scrub
+- Regularly review PRs (1-2 a week)
+- Periodically lead the kustomize bug scrub
+- Periodically release kustomize (ensuring that there are no release blockers and that release notes are clean)
+- Be the primary owner or point of contact for a particular project or area of code
+- Ideally, there should be 2-3 owners at a time. Reach out to the current owners if you are interested in ownership. These
+requirements are not strict and evaluation is somewhat subjective.
+
+## Reviewer guide
+Please watch this talk on how to review code from Tim Hockin: https://www.youtube.com/watch?v=OZVv7-o8i40
+
+For reviewing PRs in kustomize, we have some specific guidelines:
+- If the PR is introducing a new feature:
+  - *It must be implementing an issue that has already been triage/accepted or
+a KEP that has been approved.* If it is not, then request the PR author to first file an issue.
+  - The PR must include thorough tests for the new feature, including unit and integration tests
+  - The code must be clean and readable, with thought given to how we will maintain the code in the future
+  - If the feature requires being broken up into multiple PRs to ease review, the feature should not be exposed to users
+    until the feature is completed in the last PR. For example, while we were building `kustomize localize`, we
+    built the feature almost entirely under the `api` module as a library with all the needed tests. There was no way
+    for users to invoke the localize code until the last PR that actually exposed the `kustomize localize` command in the
+    kustomize binary. This allowed us to continue development of `kustomize localize` without blocking kustomize releases.
+    If this type of development is not possible, then new features requiring multiple PRs should be
+    developed in their own feature branch.
+- If the PR is introducing a bug fix:
+  - If the PR is not fixing an issue that has already been triage/accepted, follow the triage guide below on bug
+    fixes to decide if this is a PR we want to accept.
+  - The PR should have two distinct commits:
+    - The first commit should add a test demonstrating incorrect behavior
+    - The second commit should include the bug fix
+    - Some sample PRs:
+      - https://github.com/kubernetes-sigs/kustomize/pull/5263/commits
+      - https://github.com/kubernetes-sigs/kustomize/pull/3931/commits
+    - The regression test is absolutely required, and we cannot accept bug fixes without tests.
+- If the PR is introducing a performance improvement:
+  - The PR description should give an indication of how much the performance is being improved and how we
+    can measure it - benchmark tests are fantastic.
+- Other PRs (documentation, CI improvements, etc.) should be reviewed based on your best judgment.
+
+## Triage guide
+The possible triage labels are listed here: https://github.com/kubernetes-sigs/kustomize/labels?q=triage.
+
+Triaging a feature request means:
+- Understand what the user is asking for, and their use case.
+- Verify that it is not an [eschewed feature](https://kubectl.docs.kubernetes.io/faq/kustomize/eschewedfeatures/#build-time-side-effects-from-cli-args-or-env-variables)
+- Verify that it is not a duplicate issue.
+- Look into workarounds. Is there another way that the user can achieve their use case with existing features?
+- If you are new to this role, prior to leaving a comment on the issue, please bring it to weekly standup
+for group discussion to make sure that we are all on the same page.
+- Once you feel ready, you can label it with a triage label. Here's an [example](https://github.com/kubernetes-sigs/kustomize/issues/5049). You can also
+look at other feature request issues to see how they were triaged and resolved. There are a few different triage labels that you can use, you can see the
+full list [here](https://github.com/kubernetes-sigs/kustomize/labels?q=triage).
+
+Triaging a bug means:
+- First, verify that you can reproduce the issue. If you cannot reproduce the issue or need more information to give
+it a go, triage it accordingly.
+- Try to understand if this is really a bug or if this is intended behavior from kustomize. If it seems like intended
+behavior, do your best to explain to the user why this is the case.
+- If it seems to be a genuine bug, you can /triage accept the issue. In addition, investigate if there are workarounds or
+alternative solutions for the user that they can try until the issue gets resolved.
+
+The triage party for kustomize is here https://cli.triage.k8s.io/s/kustomize and can be a easy way to
+find issues that have not been triaged yet.
+
+## Project/Product Managers
+
+Kustomize will have opportunities to join in a project/product manager role. You can reach out to
+the existing kustomize maintainers if you are interested in this type of role. Project management work
+can greatly help supplement your contributions as you climb from reviewer to approver
+to owner.
+
+Expectations for this role are:
+
+- Triage 1 feature request each week, and bring it to weekly stand-up for discussion. Feature
+requests are issues labeled kind/feature, and you can find them [here](https://github.com/kubernetes-sigs/kustomize/issues?q=is%3Aissue+is%3Aopen+kind+feature+label%3Akind%2Ffeature).
+Please view the above triage guide for details on how to approach feature request triage.
+- Monitor the kustomize Slack channel and try to help users if you can. It is a pretty
+active channel, so responding to 4-5 users per week is sufficient even if some
+questions go unanswered. If there is an interesting topic or a recurring problem that many
+users are having, please bring it up in weekly stand-up.
+- Keeping track of a queue of backlog issues or PRs that are not being actively looked at in any existing project board.
+- Organizing or reorganizing project tracking boards when it makes sense.
+
+You will also be asked to help with roadmap planning, deprecation communication, prioritization,
+and doing research on kustomize usage when appropriate, though these responsibilities will occur less
+frequently.
+
+## Administrative notes:
 
 - The [OWNERS file spec] is a useful resources in making changes.
 - Maintainers and admins must be added to the appropriate lists in both [Kustomize OWNERS_ALIASES] and [SIG-CLI Teams]. If this isn't done, the individual in question will lack either PR approval rights (Kustomize list) or the appropriate Github repository permissions (community list).
 
-
 ## Contact Information
 
 - [Slack channel]

Makefile

@@ -3,7 +3,7 @@
 #
 # Makefile for kustomize CLI and API.
 
-LATEST_RELEASE=v5.0.3
+LATEST_RELEASE=v5.2.1
 
 SHELL := /usr/bin/env bash
 GOOS = $(shell go env GOOS)
@@ -108,6 +108,9 @@ verify-kustomize-repo: \
 .PHONY: prow-presubmit-check
 prow-presubmit-check: \
 	install-tools \
+	workspace-sync \
+	generate-kustomize-builtin-plugins \
+	builtin-plugins-diff \
 	test-unit-kustomize-plugins \
 	test-go-mod \
 	build-non-plugin-all \
@@ -126,6 +129,14 @@ check-license: $(MYGOBIN)/addlicense
 lint: $(MYGOBIN)/golangci-lint $(MYGOBIN)/goimports $(builtinplugins)
 	./hack/for-each-module.sh "make lint"
 
+.PHONY: apidiff
+apidiff: go-apidiff ## Run the go-apidiff to verify any API differences compared with origin/master
+	$(GOBIN)/go-apidiff master --compare-imports --print-compatible --repo-path=.
+
+.PHONY: go-apidiff
+go-apidiff:
+	go install github.com/joelanford/go-apidiff@v0.6.0
+
 .PHONY: test-unit-all
 test-unit-all: \
 	test-unit-non-plugin \
@@ -134,11 +145,11 @@ test-unit-all: \
 # This target is used by our Github Actions CI to run unit tests for all non-plugin modules in multiple GOOS environments.
 .PHONY: test-unit-non-plugin
 test-unit-non-plugin:
-	./hack/for-each-module.sh "make test" "./plugin/*" 16
+	./hack/for-each-module.sh "make test" "./plugin/*" 19
 
 .PHONY: build-non-plugin-all
 build-non-plugin-all:
-	./hack/for-each-module.sh "make build" "./plugin/*" 16
+	./hack/for-each-module.sh "make build" "./plugin/*" 19
 
 .PHONY: test-unit-kustomize-plugins
 test-unit-kustomize-plugins:
@@ -173,7 +184,12 @@ test-examples-kustomize-against-HEAD: $(MYGOBIN)/kustomize $(MYGOBIN)/mdrip
 test-examples-kustomize-against-latest-release: $(MYGOBIN)/mdrip
 	./hack/testExamplesAgainstKustomize.sh v5@$(LATEST_RELEASE)
 
-
+# Pushes dependencies in the go.work file back to go.mod files of each workspace module.
+.PHONY: workspace-sync
+workspace-sync:
+	go work sync
+	./hack/doGoMod.sh tidy
+	
 # --- Cleanup targets ---
 .PHONY: clean
 clean: clean-kustomize-external-go-plugin uninstall-tools

Makefile-plugins.mk

@@ -89,9 +89,27 @@ $(pGen)/%.go: $(MYGOBIN)/pluginator $(MYGOBIN)/goimports
 		$(MYGOBIN)/goimports -w $*.go \
 	)
 
-# Target is for debugging.
+# Generate builtin plugins
 .PHONY: generate-kustomize-builtin-plugins
-generate-kustomize-builtin-plugins: $(builtinplugins)
+generate-kustomize-builtin-plugins: $(builtplugins)
+	for plugin in $(abspath $(wildcard $(pSrc)/*)); do \
+		echo "generating $${plugin} ..."; \
+		set -e; \
+		cd $${plugin}; \
+		go generate pluginator .; \
+	done
+
+# Check for diff by comparing current revision of generated plugins on HEAD and newly generated plugins on local branch, 
+# If diff is found, throw error code 1
+.PHONY: builtin-plugins-diff
+builtin-plugins-diff: $(builtplugins)
+	for file in $(abspath $(builtinplugins)); do \
+		echo "Checking for diff... $${file}" ; \
+		set -e ; \
+		if [ "`git diff $${file} | wc -c`" -gt 0 ]; then\
+			echo "Error(1): diff found on $${file}"; exit 1; \
+		fi \
+	done
 
 .PHONY: build-kustomize-external-go-plugin
 build-kustomize-external-go-plugin:

OWNERS_ALIASES

@@ -8,12 +8,16 @@ aliases:
     - knverey
     - natasha41575
     - annasong20
+    - koba1t
   kustomize-reviewers:
     - knverey
     - natasha41575
     - yuwenma
     - annasong20
     - koba1t
+    - stormqueen1990
+    - varshaprasad96
+    - ncapps
   #  emeritus:
   #    - liujingfang1
   #    - Shell32-Natsu

README.md

@@ -36,11 +36,16 @@ be updated on a regular basis going forward, and such updates
 will be reflected in the Kubernetes release notes.
 
 | Kubectl version | Kustomize version |
-| --- | --- |
-| < v1.14 | n/a |
-| v1.14-v1.20 | v2.0.3 |
-| v1.21 | v4.0.5 |
-| v1.22 | v4.2.0 |
+| --------------- | ----------------- |
+| < v1.14         | n/a               |
+| v1.14-v1.20     | v2.0.3            |
+| v1.21           | v4.0.5            |
+| v1.22           | v4.2.0            |
+| v1.23           | v4.4.1            |
+| v1.24           | v4.5.4            |
+| v1.25           | v4.5.7            |
+| v1.26           | v4.5.7            |
+| v1.27           | v5.0.1            |
 
 [v2.0.3]: https://github.com/kubernetes-sigs/kustomize/releases/tag/v2.0.3
 [#2506]: https://github.com/kubernetes-sigs/kustomize/issues/2506
@@ -63,7 +68,37 @@ This file should declare those resources, and any
 customization to apply to them, e.g. _add a common
 label_.
 
-![base image][imageBase]
+```
+
+base: kustomization + resources
+
+kustomization.yaml                                      deployment.yaml                                                 service.yaml
++---------------------------------------------+         +-------------------------------------------------------+       +-----------------------------------+
+| apiVersion: kustomize.config.k8s.io/v1beta1 |         | apiVersion: apps/v1                                   |       | apiVersion: v1                    |
+| kind: Kustomization                         |         | kind: Deployment                                      |       | kind: Service                     |
+| commonLabels:                               |         | metadata:                                             |       | metadata:                         |
+|   app: myapp                                |         |   name: myapp                                         |       |   name: myapp                     |
+| resources:                                  |         | spec:                                                 |       | spec:                             |
+|   - deployment.yaml                         |         |   selector:                                           |       |   selector:                       |
+|   - service.yaml                            |         |     matchLabels:                                      |       |     app: myapp                    |
+| configMapGenerator:                         |         |       app: myapp                                      |       |   ports:                          |
+|   - name: myapp-map                         |         |   template:                                           |       |     - port: 6060                  |
+|     literals:                               |         |     metadata:                                         |       |       targetPort: 6060            |
+|       - KEY=value                           |         |       labels:                                         |       +-----------------------------------+
++---------------------------------------------+         |         app: myapp                                    |
+                                                        |     spec:                                             |
+                                                        |       containers:                                     |
+                                                        |         - name: myapp                                 |
+                                                        |           image: myapp                                |
+                                                        |           resources:                                  |
+                                                        |             limits:                                   |
+                                                        |               memory: "128Mi"                         |
+                                                        |               cpu: "500m"                             |
+                                                        |           ports:                                      |
+                                                        |             - containerPort: 6060                     |
+                                                        +-------------------------------------------------------+
+
+```
 
 File structure:
 
@@ -99,20 +134,41 @@ Manage traditional [variants] of a configuration - like
 _development_, _staging_ and _production_ - using
 [overlays] that modify a common [base].
 
-![overlay image][imageOverlay]
+```
+
+overlay: kustomization + patches
+
+kustomization.yaml                                      replica_count.yaml                      cpu_count.yaml
++-----------------------------------------------+       +-------------------------------+       +------------------------------------------+
+| apiVersion: kustomize.config.k8s.io/v1beta1   |       | apiVersion: apps/v1           |       | apiVersion: apps/v1                      |
+| kind: Kustomization                           |       | kind: Deployment              |       | kind: Deployment                         |
+| commonLabels:                                 |       | metadata:                     |       | metadata:                                |  
+|   variant: prod                               |       |   name: myapp                 |       |   name: myapp                            |
+| resources:                                    |       | spec:                         |       | spec:                                    |
+|   - ../../base                                |       |   replicas: 80                |       |  template:                               |
+| patches:                                      |       +-------------------------------+       |     spec:                                |
+|   - path: replica_count.yaml                  |                                               |       containers:                        |
+|   - path: cpu_count.yaml                      |                                               |         - name: myapp                    |  
++-----------------------------------------------+                                               |           resources:                     |
+                                                                                                |             limits:                      |
+                                                                                                |               memory: "128Mi"            |
+                                                                                                |               cpu: "7000m"               |
+                                                                                                +------------------------------------------+
+```
+
 
 File structure:
 > ```
 > ~/someApp
 > ├── base
-> │   ├── deployment.yaml
-> │   ├── kustomization.yaml
-> │   └── service.yaml
+> │   ├── deployment.yaml
+> │   ├── kustomization.yaml
+> │   └── service.yaml
 > └── overlays
 >     ├── development
->     │   ├── cpu_count.yaml
->     │   ├── kustomization.yaml
->     │   └── replica_count.yaml
+>     │   ├── cpu_count.yaml
+>     │   ├── kustomization.yaml
+>     │   └── replica_count.yaml
 >     └── production
 >         ├── cpu_count.yaml
 >         ├── kustomization.yaml
@@ -166,8 +222,6 @@ is governed by the [Kubernetes Code of Conduct].
 [applied]: https://kubectl.docs.kubernetes.io/references/kustomize/glossary/#apply
 [base]: https://kubectl.docs.kubernetes.io/references/kustomize/glossary/#base
 [declarative configuration]: https://kubectl.docs.kubernetes.io/references/kustomize/glossary/#declarative-application-management
-[imageBase]: images/base.jpg
-[imageOverlay]: images/overlay.jpg
 [kubectl announcement]: https://kubernetes.io/blog/2019/03/25/kubernetes-1-14-release-announcement
 [kubernetes documentation]: https://kubernetes.io/docs/tasks/manage-kubernetes-objects/kustomization/
 [kubernetes style]: https://kubectl.docs.kubernetes.io/references/kustomize/glossary/#kubernetes-style-object

ROADMAP.md

@@ -1,112 +1,185 @@
-# Kustomize roadmap 2022
+# Kustomize roadmap 2023-2024
 
-Presented at the [January 26, 2022, SIG-CLI meeting](https://youtu.be/l2plzJ9MRlk?t=1321)
+This document describes the items that we hope to make progress on over the next
+1 year (H2 2023 and H1 2024). Take this roadmap as more of what we hope to achieve
+rather than what we promise to achieve, as some items in this doc are highly dependent
+on the success that we have on-ramping new contributors to the project, and other
+items will depend on external contributions, which can vary.
 
-kustomize maintainers: @knverey, @natasha41575
+If you are interested in contributing to a particular area, you can look through
+the project board for that area and assign yourself to one of the issues. It is
+recommended to start with smaller issues to ramp up on the project before starting
+to tackle larger issues.
 
-[Objective: Improve contributor community](#objective-improve-contributor-community)
+Project boards:
+https://github.com/orgs/kubernetes-sigs/projects/50
+https://github.com/orgs/kubernetes-sigs/projects/51
+https://github.com/orgs/kubernetes-sigs/projects/52
+https://github.com/orgs/kubernetes-sigs/projects/53
+https://github.com/orgs/kubernetes-sigs/projects/54
 
-[Objective: Improve end-user experience](#objective-improve-end-user-experience)
+## Kustomize contributors (at time of writing):
 
-[Objective: Improve extension experience](#objective-improve-extension-experience)
+kustomize owner: @natasha41575
 
-## Objective: Improve contributor community
+kustomize maintainers: @annasong20, @koba1t
 
-**_WHO: End user who also contributes source code._**
-
-Top priority:
-
-- Kustomization v1 (also end-user impact) ([PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/12))
-  - Remove the following fields:
-    - [vars](https://github.com/kubernetes-sigs/kustomize/issues/2052)
-    - [patchesJson6902, patchesStrategicMerge (consolidate on \`patches)](https://github.com/kubernetes-sigs/kustomize/issues/4376)
-    - [helmChartInflationGenerator, helmCharts, helmGlobals](https://github.com/kubernetes-sigs/kustomize/issues/4401)
-    - all long-deprecated fields in Kustomization v1 such as \`bases\` and those being accommodate by kustomize edit \[[see code snippet](https://github.com/kubernetes-sigs/kustomize/blob/ee4b7847f0beb6c0d2070673b10f23f7b3e92e82/api/types/fix.go#L15)\]
-  - Ensure that \`kustomize edit fix\` handles migrations for all those, and that anything it changes is not still present in v1.
-  - [Add reorder field](https://github.com/kubernetes-sigs/kustomize/issues/3913). Default should be FIFO and legacy should also be supported (could add alphabetic and custom sort support eventually). Replaces -reorder flag.
-  - [Reconcile openapi and crds field](https://github.com/kubernetes-sigs/kustomize/issues/3944)
-  - [Consider deprecating configurations field](https://github.com/kubernetes-sigs/kustomize/issues/3945) (old, pre-plugin, pre-openapi global configuration)
-  - [Add a field to enable the managedby label](https://github.com/kubernetes-sigs/kustomize/issues/4047)
-
-Second priority:
-
-- Improve contributor documentation
-  - [Instructions to upgrade kustomize-in-kubectl](https://github.com/kubernetes-sigs/kustomize/issues/3951)
-
-Also very valuable to the project:
-
-- [Improve the release process](https://github.com/kubernetes-sigs/kustomize/issues/3952) to support regular biweekly releases [PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/7)
-- Release sigs.k8s.io/kustomize/api v1.0.0 [PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/5)
-  - [Reduce the public surface of the API module](https://github.com/kubernetes-sigs/kustomize/issues/3942)
-  - [Vendor all transitive deps](https://github.com/kubernetes-sigs/kustomize/issues/3706). Since kustomize is in kubectl, we must do as kubectl does to manage deps, exposing new transitive deps in code review.
-- Project administration
-  - [Rename master branch to main](https://github.com/kubernetes-sigs/kustomize/issues/3954)
+kustomize contributors: @varshaprasad96
 
 
+# H2 2023
 
-## Objective: Improve end-user experience
+## Goal: Create kustomize leadership and contributor playbooks
 
-**_WHO: End user that wants kustomize build artifacts (binaries, containers)._**
+Contributors: natasha41575, annasong20
 
-Top priorities:
+Priority: High
 
-- Bug fixes:
-  - Fix bugs in basic anchor support: [issue query](https://github.com/kubernetes-sigs/kustomize/issues?q=is%3Aopen+is%3Aissue+label%3Aarea%2Fanchors)
-  - integer keys support: [#3446](https://github.com/kubernetes-sigs/kustomize/issues/3446)
-  - kyaml not respecting \`$patch replace|retainKeys\`: [#2037](https://github.com/kubernetes-sigs/kustomize/issues/2037)
-  - kustomize removing quotes from namespace field values: [#4146](https://github.com/kubernetes-sigs/kustomize/issues/4146)
-  - Kustomize doesn’t support metadata.generateName: [#641](https://github.com/kubernetes-sigs/kustomize/issues/641)
-- Send kustomize CLI version number into kubectl ([kubectl issue](https://github.com/kubernetes/kubectl/issues/797) / [kustomize issue](https://github.com/kubernetes-sigs/kustomize/issues/1424))
-- Kustomize performance investigations/improvements [PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/13)
-- [Support generic resource references in name reference tracking](https://github.com/kubernetes-sigs/kustomize/issues/3418)
-- [KEP 4267: retain the resource origin and transformer data in annotations](https://github.com/kubernetes-sigs/kustomize/pull/4267)
+Effort: Medium
 
-Secondary priorities:
+In the past, when the leads stopped contributing (for various reasons, not covered here)
+in various kubernetes projects, it left a wide hole that few could easily fill,
+leaving the remaining leads in a bad position and the project understaffed. We should assume
+that we will need to onboard new maintainers in the future, and should have playbooks
+for doing so. As we grow the contributor base in kustomize, we will build these playbooks for
+those who are contributing and those who are looking to grow into kustomize leaders.
+To ensure the long term health and stability of the project, we should have:
 
-- kustomize cli v5 ([PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/14))
-  - [Drop the --reorder flag](https://github.com/kubernetes-sigs/kustomize/issues/3947)
-  - [Graduate cfg read-only commands out of alpha](https://github.com/kubernetes-sigs/kustomize/issues/4090).
-  - [Drop the –enable-managedby-label](https://github.com/kubernetes-sigs/kustomize/issues/4047)
-  - Drop old plugin-related fields in favor of [the Catalog-style fields](https://github.com/kubernetes/enhancements/tree/master/keps/sig-cli/2906-kustomize-function-catalog).
-  - [Drop the helm flags](https://github.com/kubernetes-sigs/kustomize/issues/4401)
-- [Confusion around namespace replacement](https://github.com/kubernetes-sigs/kustomize/issues/880).
+- On-boarding guides for new contributors
+- Clear guidelines for how to climb the kustomize ladder from contributor to approver to owner
+- A plan (maybe a schedule) for future kustomize cohorts
+- A succession plan, in case the current kustomize leads ever decide to step down
 
-Also very valuable to the project:
+## Goal: Onboard 2-5 new contributors to kustomize
 
-- [Overinclusion of root directory error in error messages](https://github.com/kubernetes-sigs/kustomize/issues/4348)
-- [Add kustomize localize command](https://github.com/kubernetes-sigs/kustomize/issues/3980)
-- [Fix Windows support in test suite](https://github.com/kubernetes-sigs/kustomize/issues/4001)
-- Improve end-user documentation [PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/9)
+Contributors: natasha41575, annasong20, koba1t
 
+Priority: High
 
-## Objective: Improve extension experience
+Effort: High
 
-**_WHO: Plugin developers: end users who extend kustomize, but don’t think about internals._**
+In order to make progress on kustomize goals in the future, we need to increase the
+level of staffing on kustomize. We should leverage community contributions to keep kustomize
+healthy and making progress.
 
-This objective is described in detail in the [Kustomize Plugin Graduation KEP](https://github.com/kubernetes/enhancements/tree/master/keps/sig-cli/2953-kustomize-plugin-graduation) / [PROJECT](https://github.com/kubernetes-sigs/kustomize/projects/15) .
+The primary means in which we will try to find new kustomize contributors is through the new kustomize
+maintainer training cohort. We will lead a group of ~20 kubernetes community members through a 3-6 month
+training program, involving talk sessions, bug scrubs, issue triage, PR reviews, and coding projects for
+each member.
 
-Top priorities:
+See [our call for help](https://groups.google.com/a/kubernetes.io/g/dev/c/M5OphEVsv5o/m/zc6G4H15AAAJ) for more
+specific details about the program.
 
-- Fix core usability issues with KRM Function extensions:
-  - [Better errors for function config failures](https://github.com/kubernetes-sigs/kustomize/issues/4398)
-  - [Container KRM Mounts are not mounting via function parameters](https://github.com/kubernetes-sigs/kustomize/issues/4290)
-  - [Resolution of local file references in extensions transformer configuration](https://github.com/kubernetes-sigs/kustomize/issues/4154)
-  - [Do not silently ignore plugins when config has typo](https://github.com/kubernetes-sigs/kustomize/issues/4399)
-  - [KRM Exec Function can't locate executable when referencing a base](https://github.com/kubernetes-sigs/kustomize/issues/4347)
-- Once core usability issues are fixed, [deprecate legacy exec and Go plugin support](https://github.com/kubernetes/enhancements/tree/master/keps/sig-cli/2953-kustomize-plugin-graduation)
-- [Catalog KEP](https://github.com/kubernetes/enhancements/tree/master/keps/sig-cli/2906-kustomize-function-catalog)
+The effort from existing kustomize maintainers here will be to:
+- Organize the cohort, so that each cohort member feels productive and understands what they should work on
+- Align motivation of the cohort members with the work that we assign to them.
+- Review PRs from cohort members in a timely manner.
+- Be the point(s) of contact for questions/escalations
+- Lead weekly stand-ups and monthly bug scrubs
 
-Secondary priorities:
+At the end of all this, if we have a small team of contributors to kustomize, who understand its founding
+philosophy and intentions, we should be able to keep the project up to date.
 
-- [Remove Starlark support](https://github.com/kubernetes-sigs/kustomize/issues/4349)
-- [Composition KEP](https://github.com/kubernetes/enhancements/pull/2300). The implementation is complete in [#4223](https://github.com/kubernetes-sigs/kustomize/pull/4323), but depends on:
-  - [Convert resources and components to be backed by a reusable generator](https://github.com/kubernetes-sigs/kustomize/issues/4402)
-  - [Enable explicitly invoked transformers to use default fieldSpecs](https://github.com/kubernetes-sigs/kustomize/issues/4404)
-  - [Enable built-in generators to be used in the transformers field ](https://github.com/kubernetes-sigs/kustomize/issues/4403)
+## Goal: Improve kustomize extensibility through KRM functions and CRD support
 
+Contributors: koba1t, varshaprasad96, external contributors
 
-Also very valuable to the project:
+Priority: High
 
-- [Improve docs for kyaml libraries](https://github.com/kubernetes-sigs/kustomize/issues/3950), especially by adding examples.
-- [Create a reserved field for plugin runtime information](https://github.com/kubernetes-sigs/kustomize/issues/4405)
-- [Develop new standard process for implementing builtin transformers](https://github.com/kubernetes-sigs/kustomize/issues/4400)
+Effort: High
+
+Project board: https://github.com/orgs/kubernetes-sigs/projects/53/views/1
+
+For a long time, we have supported KRM functions as the proper way to implement custom generators and transformers.
+However, due to limited staffing, we have been unable to drive this feature out of alpha in kustomize. The two
+main features which we hope to make progress on are Composition and Catalog, two long-standing proposals for which
+numerous users have been waiting for a long time. There are several open issues
+regarding KRM functions where our long-term answer has been these two features, but users have been hearing about them
+for over a year without seeing any progress. If we can implement them, they will vastly improve usability and security
+of KRM functions.
+
+One item that falls under this category that does not currently have a contributor is improving CRD support.
+Currently, it is difficult to use CRDs properly, as there are three different fields (configurations, openapi, and crds)
+where users have to input their CRD configuration. We need to consolidate these fields into one easy to use feature to
+support CRDs. If you are interested in putting together a design proposal for how to tackle this task, please reach
+out to the kustomize maintainers.
+
+# H1 2024
+
+## Goal: Improve the kustomize documentation
+
+Contributors: annasong20, external contributions
+
+Priority: High
+
+Effort: High
+
+Project board: https://github.com/orgs/kubernetes-sigs/projects/50
+
+The kustomize documentation is currently fragmented, out of date, and lacks examples to fully understand its value.
+We have had a "docs project" for a long time; we need to prioritize implementing it so that the documentation is in
+one place, easy to find, and helps new users get started more easily. Some outcomes from this project should be:
+
+- A single, unified website hosted on kustomize.io
+- Updated information architecture, and a plan to keep it up to date
+- End to end examples of using kustomize, including complex use cases
+
+## Goal: Fix core usability bugs in kustomize
+
+Contributors: external contributions
+
+Priority: High
+
+Effort: High
+
+Project board: https://github.com/orgs/kubernetes-sigs/projects/51
+
+There are several core usability issues that block some users from adopting kustomize features or in
+some base block users from using kustomize entirely. These issues range from small bugs with workable but
+inconvenient workarounds, to enormous feature gaps.
+
+As part of this goal, we should work toward reducing the number of such issues that we have, making
+kustomize work more smoothly and predictably, and be usable for a larger range of users.
+
+There are a lot of important issues in this project, but the biggest and highest priority one is that
+kustomize doesn't currently support metadata.GenerateName. Unfortunately, we don't currently have anyone
+actively working on this issue, we would need an external contributor to reach out to the kustomize
+maintainers to pick it up.
+
+## Goal: Improve kustomize CI, release, & security patch processes
+
+Contributors: external contributions
+
+Priority: Medium
+
+Effort: High
+
+Project board: https://github.com/orgs/kubernetes-sigs/projects/54
+
+The kustomize release process is currently done on-demand and is strictly linear. This means that if we find a CVE,
+we are forced to release the next version of kustomize ASAP, and we are required to release every PR that has merged
+since the last release. This can put us in a sticky situation if we have a breaking change that we are
+not ready to release yet, but we need a patch quickly.
+
+We should try to improve the kustomize release process so that we can release frequently, reliably, and with some
+flexibility. The outcome of this effort should be:
+
+- kustomize is released on a regular cadence (biweekly or monthly)
+- kustomize is able to separate patch and feature releases, so that we can fix CVEs without needing to release
+everything that we have in flight
+- We can detect and fix CVEs early
+
+## Goal: Take long-standing alpha commands out of alpha
+
+Contributors: external contributions
+
+Priority: Medium
+
+Effort: Medium
+
+Project board: https://github.com/orgs/kubernetes-sigs/projects/52
+
+There are several commands in kustomize that have been alpha for a long time, including the cfg command group and
+localize. Moving them forward can indicate good health of a project and these commands are useful to many users.
+Some of these projects can be good starter issues for new contributors to have an easier onramp while others will
+require more effort and thought.

SECURITY_CONTACTS

@@ -9,7 +9,7 @@
 #
 # DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, FOLLOW THE
 # INSTRUCTIONS AT https://kubernetes.io/security/
-
-monopole
-Liujingfang1
-pwittrock
+eddiezane
+KnVerey
+natasha41575
+soltysh

api/filters/imagetag/updater.go

@@ -6,7 +6,7 @@ package imagetag
 import (
 	"sigs.k8s.io/kustomize/api/filters/filtersutil"
 
-	"sigs.k8s.io/kustomize/api/image"
+	"sigs.k8s.io/kustomize/api/internal/image"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )

api/filters/patchjson6902/patchjson6902.go

@@ -6,7 +6,7 @@ package patchjson6902
 import (
 	"strings"
 
-	jsonpatch "github.com/evanphx/json-patch"
+	jsonpatch "gopkg.in/evanphx/json-patch.v5"
 	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 	k8syaml "sigs.k8s.io/yaml"

api/filters/patchstrategicmerge/patchstrategicmerge_test.go

@@ -776,6 +776,133 @@ spec:
       autoscaling: true
     deepgram-api:
       some: value
+`,
+		},
+
+		// Issue #4928
+		"support numeric keys": {
+			input: `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blabla
+  namespace: blabla-ns
+data:
+  "6443": "foobar"
+`,
+			patch: yaml.MustParse(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blabla
+  namespace: blabla-ns
+data:
+  "6443": "barfoo"
+  "9110": "foo-foo"
+`),
+			expected: `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blabla
+  namespace: blabla-ns
+data:
+  "6443": "barfoo"
+  "9110": "foo-foo"
+`,
+		},
+
+		"honor different key style one": {
+			input: `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blabla
+  namespace: blabla-ns
+data:
+  '6443': "foobar"
+`,
+			patch: yaml.MustParse(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blabla
+  namespace: blabla-ns
+data:
+  "6443": "barfoo"
+  9110: "foo-foo"
+`),
+			expected: `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blabla
+  namespace: blabla-ns
+data:
+  '6443': "barfoo"
+  9110: "foo-foo"
+`,
+		},
+
+		"honor different key style two": {
+			input: `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blabla
+  namespace: blabla-ns
+data:
+  "6443": "foobar"
+`,
+			patch: yaml.MustParse(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blabla
+  namespace: blabla-ns
+data:
+  "6443": "barfoo"
+  '9110': "foo-foo"
+`),
+			expected: `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blabla
+  namespace: blabla-ns
+data:
+  "6443": "barfoo"
+  '9110': "foo-foo"
+`,
+		},
+
+		"different key types": {
+			input: `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blabla
+  namespace: blabla-ns
+data:
+  "6443": "key-string-double-quoted"
+`,
+			patch: yaml.MustParse(`
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blabla
+  namespace: blabla-ns
+data:
+  6443: "key-int"
+`),
+			expected: `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blabla
+  namespace: blabla-ns
+data:
+  "6443": "key-int"
 `,
 		},
 	}

api/filters/replacement/replacement.go

@@ -126,8 +126,8 @@ func applyReplacement(nodes []*yaml.RNode, value *yaml.RNode, targetSelectors []
 			}
 
 			// filter targets by matching resource IDs
-			for i, id := range ids {
-				if id.IsSelectedBy(selector.Select.ResId) && !rejectId(selector.Reject, &ids[i]) {
+			for _, id := range ids {
+				if id.IsSelectedBy(selector.Select.ResId) && !containsRejectId(selector.Reject, ids) {
 					err := copyValueToTarget(possibleTarget, value, selector)
 					if err != nil {
 						return nil, err
@@ -168,10 +168,15 @@ func matchesAnnoAndLabelSelector(n *yaml.RNode, selector *types.Selector) (bool,
 	return annoMatch && labelMatch, nil
 }
 
-func rejectId(rejects []*types.Selector, id *resid.ResId) bool {
+func containsRejectId(rejects []*types.Selector, ids []resid.ResId) bool {
 	for _, r := range rejects {
-		if !r.ResId.IsEmpty() && id.IsSelectedBy(r.ResId) {
-			return true
+		if r.ResId.IsEmpty() {
+			continue
+		}
+		for _, id := range ids {
+			if id.IsSelectedBy(r.ResId) {
+				return true
+			}
 		}
 	}
 	return false

api/go.mod

@@ -3,15 +3,15 @@ module sigs.k8s.io/kustomize/api
 go 1.20
 
 require (
-	github.com/evanphx/json-patch v4.12.0+incompatible
 	github.com/go-errors/errors v1.4.2
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
-	github.com/imdario/mergo v0.3.6
+	github.com/imdario/mergo v0.3.13
 	github.com/stretchr/testify v1.8.1
-	gopkg.in/yaml.v2 v2.4.0
+	go.uber.org/goleak v1.3.0
+	gopkg.in/evanphx/json-patch.v5 v5.6.0
 	k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961
-	sigs.k8s.io/kustomize/kyaml v0.14.3
-	sigs.k8s.io/yaml v1.3.0
+	sigs.k8s.io/kustomize/kyaml v0.16.0
+	sigs.k8s.io/yaml v1.4.0
 )
 
 require (
@@ -31,7 +31,7 @@ require (
 	github.com/sergi/go-diff v1.1.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
-	golang.org/x/sys v0.8.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
 	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

api/go.sum

@@ -5,8 +5,6 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
-github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
@@ -27,8 +25,8 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
-github.com/imdario/mergo v0.3.6 h1:xTNEAn+kxVO7dTZGu0CegyqKZmoWFI0rF8UxjlB2d28=
-github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
+github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -63,9 +61,11 @@ github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee331t6JAXeK2bcyhLOOc=
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
@@ -75,17 +75,18 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v5 v5.6.0 h1:BMT6KIwBD9CaU91PJCZIe46bDmBWa9ynTQgJIOpfQBk=
+gopkg.in/evanphx/json-patch.v5 v5.6.0/go.mod h1:/kvTRh1TVm5wuM6OkHxqXtE/1nUZZpihg29RtuIyfvk=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961 h1:pqRVJGQJz6oeZby8qmPKXYIBjyrcv7EHCe/33UkZMYA=
 k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961/go.mod h1:l8HTwL5fqnlns4jOveW1L75eo7R9KFHxiE0bsPGy428=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
-sigs.k8s.io/kustomize/kyaml v0.14.3 h1:WpabVAKZe2YEp/irTSHwD6bfjwZnTtSDewd2BVJGMZs=
-sigs.k8s.io/kustomize/kyaml v0.14.3/go.mod h1:npvh9epWysfQ689Rtt/U+dpOJDTBn8kUnF1O6VzvmZA=
-sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
-sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
+sigs.k8s.io/kustomize/kyaml v0.16.0 h1:6J33uKSoATlKZH16unr2XOhDI+otoe2sR3M8PDzW3K0=
+sigs.k8s.io/kustomize/kyaml v0.16.0/go.mod h1:xOK/7i+vmE14N2FdFyugIshB8eF6ALpy7jI87Q2nRh4=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=

api/internal/accumulator/loadconfigfromcrds_test.go

@@ -9,8 +9,8 @@ import (
 
 	"github.com/stretchr/testify/require"
 	. "sigs.k8s.io/kustomize/api/internal/accumulator"
+	"sigs.k8s.io/kustomize/api/internal/loader"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
-	"sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 	"sigs.k8s.io/kustomize/kyaml/resid"

api/internal/builtins/HelmChartInflationGenerator.go

@@ -53,6 +53,15 @@ func (p *HelmChartInflationGeneratorPlugin) Config(
 	if h.GeneralConfig().HelmConfig.Command == "" {
 		return fmt.Errorf("must specify --helm-command")
 	}
+
+	// CLI args takes precedence
+	if h.GeneralConfig().HelmConfig.KubeVersion != "" {
+		p.HelmChart.KubeVersion = h.GeneralConfig().HelmConfig.KubeVersion
+	}
+	if len(h.GeneralConfig().HelmConfig.ApiVersions) != 0 {
+		p.HelmChart.ApiVersions = h.GeneralConfig().HelmConfig.ApiVersions
+	}
+
 	p.h = h
 	if err = yaml.Unmarshal(config, p); err != nil {
 		return
@@ -91,7 +100,7 @@ func (p *HelmChartInflationGeneratorPlugin) validateArgs() (err error) {
 	// be under the loader root (unless root restrictions are
 	// disabled).
 	if p.ValuesFile == "" {
-		p.ValuesFile = filepath.Join(p.ChartHome, p.Name, "values.yaml")
+		p.ValuesFile = filepath.Join(p.absChartHome(), p.Name, "values.yaml")
 	}
 	for i, file := range p.AdditionalValuesFiles {
 		// use Load() to enforce root restrictions
@@ -132,10 +141,17 @@ func (p *HelmChartInflationGeneratorPlugin) errIfIllegalValuesMerge() error {
 }
 
 func (p *HelmChartInflationGeneratorPlugin) absChartHome() string {
+	var chartHome string
 	if filepath.IsAbs(p.ChartHome) {
-		return p.ChartHome
+		chartHome = p.ChartHome
+	} else {
+		chartHome = filepath.Join(p.h.Loader().Root(), p.ChartHome)
 	}
-	return filepath.Join(p.h.Loader().Root(), p.ChartHome)
+
+	if p.Version != "" && p.Repo != "" {
+		return filepath.Join(chartHome, fmt.Sprintf("%s-%s", p.Name, p.Version))
+	}
+	return chartHome
 }
 
 func (p *HelmChartInflationGeneratorPlugin) runHelmCommand(
@@ -281,8 +297,18 @@ func (p *HelmChartInflationGeneratorPlugin) pullCommand() []string {
 		"pull",
 		"--untar",
 		"--untardir", p.absChartHome(),
-		"--repo", p.Repo,
-		p.Name}
+	}
+
+	switch {
+	case strings.HasPrefix(p.Repo, "oci://"):
+		args = append(args, strings.TrimSuffix(p.Repo, "/")+"/"+p.Name)
+	case p.Repo != "":
+		args = append(args, "--repo", p.Repo)
+		fallthrough
+	default:
+		args = append(args, p.Name)
+	}
+
 	if p.Version != "" {
 		args = append(args, "--version", p.Version)
 	}

api/internal/builtins/PatchJson6902Transformer.go

@@ -6,7 +6,7 @@ package builtins
 import (
 	"fmt"
 
-	jsonpatch "github.com/evanphx/json-patch"
+	jsonpatch "gopkg.in/evanphx/json-patch.v5"
 	"sigs.k8s.io/kustomize/api/filters/patchjson6902"
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/resmap"

api/internal/builtins/PatchTransformer.go

@@ -7,104 +7,123 @@ import (
 	"fmt"
 	"strings"
 
-	jsonpatch "github.com/evanphx/json-patch"
+	jsonpatch "gopkg.in/evanphx/json-patch.v5"
 	"sigs.k8s.io/kustomize/api/filters/patchjson6902"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
 	"sigs.k8s.io/yaml"
 )
 
 type PatchTransformerPlugin struct {
-	loadedPatch  *resource.Resource
-	decodedPatch jsonpatch.Patch
-	Path         string          `json:"path,omitempty" yaml:"path,omitempty"`
-	Patch        string          `json:"patch,omitempty" yaml:"patch,omitempty"`
-	Target       *types.Selector `json:"target,omitempty" yaml:"target,omitempty"`
-	Options      map[string]bool `json:"options,omitempty" yaml:"options,omitempty"`
+	smPatches   []*resource.Resource // strategic-merge patches
+	jsonPatches jsonpatch.Patch      // json6902 patch
+	// patchText is pure patch text created by Path or Patch
+	patchText string
+	// patchSource is patch source message
+	patchSource string
+	Path        string          `json:"path,omitempty"    yaml:"path,omitempty"`
+	Patch       string          `json:"patch,omitempty"   yaml:"patch,omitempty"`
+	Target      *types.Selector `json:"target,omitempty"  yaml:"target,omitempty"`
+	Options     map[string]bool `json:"options,omitempty" yaml:"options,omitempty"`
 }
 
-func (p *PatchTransformerPlugin) Config(
-	h *resmap.PluginHelpers, c []byte) error {
-	err := yaml.Unmarshal(c, p)
-	if err != nil {
+func (p *PatchTransformerPlugin) Config(h *resmap.PluginHelpers, c []byte) error {
+	if err := yaml.Unmarshal(c, p); err != nil {
 		return err
 	}
+
 	p.Patch = strings.TrimSpace(p.Patch)
-	if p.Patch == "" && p.Path == "" {
-		return fmt.Errorf(
-			"must specify one of patch and path in\n%s", string(c))
-	}
-	if p.Patch != "" && p.Path != "" {
-		return fmt.Errorf(
-			"patch and path can't be set at the same time\n%s", string(c))
-	}
-	if p.Path != "" {
-		loaded, loadErr := h.Loader().Load(p.Path)
-		if loadErr != nil {
-			return loadErr
+	switch {
+	case p.Patch == "" && p.Path == "":
+		return fmt.Errorf("must specify one of patch and path in\n%s", string(c))
+	case p.Patch != "" && p.Path != "":
+		return fmt.Errorf("patch and path can't be set at the same time\n%s", string(c))
+	case p.Patch != "":
+		p.patchText = p.Patch
+		p.patchSource = fmt.Sprintf("[patch: %q]", p.patchText)
+	case p.Path != "":
+		loaded, err := h.Loader().Load(p.Path)
+		if err != nil {
+			return fmt.Errorf("failed to get the patch file from path(%s): %w", p.Path, err)
 		}
-		p.Patch = string(loaded)
+		p.patchText = string(loaded)
+		p.patchSource = fmt.Sprintf("[path: %q]", p.Path)
 	}
 
-	patchSM, errSM := h.ResmapFactory().RF().FromBytes([]byte(p.Patch))
-	patchJson, errJson := jsonPatchFromBytes([]byte(p.Patch))
+	patchesSM, errSM := h.ResmapFactory().RF().SliceFromBytes([]byte(p.patchText))
+	patchesJson, errJson := jsonPatchFromBytes([]byte(p.patchText))
+
 	if (errSM == nil && errJson == nil) ||
-		(patchSM != nil && patchJson != nil) {
+		(patchesSM != nil && patchesJson != nil) {
 		return fmt.Errorf(
-			"illegally qualifies as both an SM and JSON patch: [%v]",
-			p.Patch)
+			"illegally qualifies as both an SM and JSON patch: %s",
+			p.patchSource)
 	}
 	if errSM != nil && errJson != nil {
 		return fmt.Errorf(
-			"unable to parse SM or JSON patch from [%v]", p.Patch)
+			"unable to parse SM or JSON patch from %s", p.patchSource)
 	}
 	if errSM == nil {
-		p.loadedPatch = patchSM
-		if p.Options["allowNameChange"] {
-			p.loadedPatch.AllowNameChange()
-		}
-		if p.Options["allowKindChange"] {
-			p.loadedPatch.AllowKindChange()
+		p.smPatches = patchesSM
+		for _, loadedPatch := range p.smPatches {
+			if p.Options["allowNameChange"] {
+				loadedPatch.AllowNameChange()
+			}
+			if p.Options["allowKindChange"] {
+				loadedPatch.AllowKindChange()
+			}
 		}
 	} else {
-		p.decodedPatch = patchJson
+		p.jsonPatches = patchesJson
 	}
 	return nil
 }
 
 func (p *PatchTransformerPlugin) Transform(m resmap.ResMap) error {
-	if p.loadedPatch == nil {
-		return p.transformJson6902(m, p.decodedPatch)
+	if p.smPatches != nil {
+		return p.transformStrategicMerge(m)
 	}
-	// The patch was a strategic merge patch
-	return p.transformStrategicMerge(m, p.loadedPatch)
+	return p.transformJson6902(m)
 }
 
-// transformStrategicMerge applies the provided strategic merge patch
-// to all the resources in the ResMap that match either the Target or
-// the identifier of the patch.
-func (p *PatchTransformerPlugin) transformStrategicMerge(m resmap.ResMap, patch *resource.Resource) error {
-	if p.Target == nil {
+// transformStrategicMerge applies each loaded strategic merge patch
+// to the resource in the ResMap that matches the identifier of the patch.
+// If only one patch is specified, the Target can be used instead.
+func (p *PatchTransformerPlugin) transformStrategicMerge(m resmap.ResMap) error {
+	if p.Target != nil {
+		if len(p.smPatches) > 1 {
+			// detail: https://github.com/kubernetes-sigs/kustomize/issues/5049#issuecomment-1440604403
+			return fmt.Errorf("Multiple Strategic-Merge Patches in one `patches` entry is not allowed to set `patches.target` field: %s", p.patchSource)
+		}
+
+		// single patch
+		patch := p.smPatches[0]
+		selected, err := m.Select(*p.Target)
+		if err != nil {
+			return fmt.Errorf("unable to find patch target %q in `resources`: %w", p.Target, err)
+		}
+		return errors.Wrap(m.ApplySmPatch(resource.MakeIdSet(selected), patch))
+	}
+
+	for _, patch := range p.smPatches {
 		target, err := m.GetById(patch.OrgId())
 		if err != nil {
-			return err
+			return fmt.Errorf("no resource matches strategic merge patch %q: %w", patch.OrgId(), err)
+		}
+		if err := target.ApplySmPatch(patch); err != nil {
+			return errors.Wrap(err)
 		}
-		return target.ApplySmPatch(patch)
 	}
-	selected, err := m.Select(*p.Target)
-	if err != nil {
-		return err
-	}
-	return m.ApplySmPatch(resource.MakeIdSet(selected), patch)
+	return nil
 }
 
-// transformJson6902 applies the provided json6902 patch
-// to all the resources in the ResMap that match the Target.
-func (p *PatchTransformerPlugin) transformJson6902(m resmap.ResMap, patch jsonpatch.Patch) error {
+// transformJson6902 applies json6902 Patch to all the resources in the ResMap that match Target.
+func (p *PatchTransformerPlugin) transformJson6902(m resmap.ResMap) error {
 	if p.Target == nil {
-		return fmt.Errorf("must specify a target for patch %s", p.Patch)
+		return fmt.Errorf("must specify a target for JSON patch %s", p.patchSource)
 	}
 	resources, err := m.Select(*p.Target)
 	if err != nil {
@@ -114,7 +133,7 @@ func (p *PatchTransformerPlugin) transformJson6902(m resmap.ResMap, patch jsonpa
 		res.StorePreviousId()
 		internalAnnotations := kioutil.GetInternalAnnotations(&res.RNode)
 		err = res.ApplyFilter(patchjson6902.Filter{
-			Patch: p.Patch,
+			Patch: p.patchText,
 		})
 		if err != nil {
 			return err
@@ -129,16 +148,17 @@ func (p *PatchTransformerPlugin) transformJson6902(m resmap.ResMap, patch jsonpa
 	return nil
 }
 
-// jsonPatchFromBytes loads a Json 6902 patch from
-// a bytes input
-func jsonPatchFromBytes(
-	in []byte) (jsonpatch.Patch, error) {
+// jsonPatchFromBytes loads a Json 6902 patch from a bytes input
+func jsonPatchFromBytes(in []byte) (jsonpatch.Patch, error) {
 	ops := string(in)
 	if ops == "" {
 		return nil, fmt.Errorf("empty json patch operations")
 	}
 
 	if ops[0] != '[' {
+		// TODO(5049):
+		//   In the case of multiple yaml documents, return error instead of ignoring all but first.
+		//   Details: https://github.com/kubernetes-sigs/kustomize/pull/5194#discussion_r1256686728
 		jsonOps, err := yaml.YAMLToJSON(in)
 		if err != nil {
 			return nil, err

api/internal/generators/configmap_test.go

@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	. "sigs.k8s.io/kustomize/api/internal/generators"
 	"sigs.k8s.io/kustomize/api/kv"
-	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/pkg/loader"
 	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/filesys"

api/internal/generators/secret_test.go

@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	. "sigs.k8s.io/kustomize/api/internal/generators"
 	"sigs.k8s.io/kustomize/api/kv"
-	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/pkg/loader"
 	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/filesys"

api/internal/git/cloner.go

@@ -22,10 +22,16 @@ func ClonerUsingGitExec(repoSpec *RepoSpec) error {
 	if err = r.run("init"); err != nil {
 		return err
 	}
+	// git relative submodule need origin, see https://github.com/kubernetes-sigs/kustomize/issues/5131
+	if err = r.run("remote", "add", "origin", repoSpec.CloneSpec()); err != nil {
+		return err
+	}
 	ref := "HEAD"
 	if repoSpec.Ref != "" {
 		ref = repoSpec.Ref
 	}
+	// we use repoSpec.CloneSpec() instead of origin because on error,
+	// the prior prints the actual repo url for the user.
 	if err = r.run("fetch", "--depth=1", repoSpec.CloneSpec(), ref); err != nil {
 		return err
 	}

api/internal/image/image_test.go

@@ -1,12 +1,13 @@
 // Copyright 2020 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-package image
+package image_test
 
 import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/internal/image"
 )
 
 func TestIsImageMatched(t *testing.T) {
@@ -50,7 +51,7 @@ func TestIsImageMatched(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.testName, func(t *testing.T) {
-			assert.Equal(t, tc.isMatched, IsImageMatched(tc.value, tc.name))
+			assert.Equal(t, tc.isMatched, image.IsImageMatched(tc.value, tc.name))
 		})
 	}
 }
@@ -116,7 +117,7 @@ func TestSplit(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.testName, func(t *testing.T) {
-			name, tag, digest := Split(tc.value)
+			name, tag, digest := image.Split(tc.value)
 			assert.Equal(t, tc.name, name)
 			assert.Equal(t, tc.tag, tag)
 			assert.Equal(t, tc.digest, digest)

api/internal/loader/fileloader.go

@@ -25,7 +25,7 @@ func IsRemoteFile(path string) bool {
 	return err == nil && (u.Scheme == "http" || u.Scheme == "https")
 }
 
-// fileLoader is a kustomization's interface to files.
+// FileLoader is a kustomization's interface to files.
 //
 // The directory in which a kustomization file sits
 // is referred to below as the kustomization's _root_.
@@ -38,49 +38,48 @@ func IsRemoteFile(path string) bool {
 //
 // * supplemental data paths
 //
-//   `Load` is used to visit these paths.
+//	`Load` is used to visit these paths.
 //
-//   These paths refer to resources, patches,
-//   data for ConfigMaps and Secrets, etc.
+//	These paths refer to resources, patches,
+//	data for ConfigMaps and Secrets, etc.
 //
-//   The loadRestrictor may disallow certain paths
-//   or classes of paths.
+//	The loadRestrictor may disallow certain paths
+//	or classes of paths.
 //
 // * bases (other kustomizations)
 //
-//   `New` is used to load bases.
+//	`New` is used to load bases.
 //
-//   A base can be either a remote git repo URL, or
-//   a directory specified relative to the current
-//   root. In the former case, the repo is locally
-//   cloned, and the new loader is rooted on a path
-//   in that clone.
+//	A base can be either a remote git repo URL, or
+//	a directory specified relative to the current
+//	root. In the former case, the repo is locally
+//	cloned, and the new loader is rooted on a path
+//	in that clone.
 //
-//   As loaders create new loaders, a root history
-//   is established, and used to disallow:
+//	As loaders create new loaders, a root history
+//	is established, and used to disallow:
 //
-//   - A base that is a repository that, in turn,
-//     specifies a base repository seen previously
-//     in the loading stack (a cycle).
+//	- A base that is a repository that, in turn,
+//	  specifies a base repository seen previously
+//	  in the loading stack (a cycle).
 //
-//   - An overlay depending on a base positioned at
-//     or above it.  I.e. '../foo' is OK, but '.',
-//     '..', '../..', etc. are disallowed.  Allowing
-//     such a base has no advantages and encourages
-//     cycles, particularly if some future change
-//     were to introduce globbing to file
-//     specifications in the kustomization file.
+//	- An overlay depending on a base positioned at
+//	  or above it.  I.e. '../foo' is OK, but '.',
+//	  '..', '../..', etc. are disallowed.  Allowing
+//	  such a base has no advantages and encourages
+//	  cycles, particularly if some future change
+//	  were to introduce globbing to file
+//	  specifications in the kustomization file.
 //
 // These restrictions assure that kustomizations
 // are self-contained and relocatable, and impose
 // some safety when relying on remote kustomizations,
 // e.g. a remotely loaded ConfigMap generator specified
 // to read from /etc/passwd will fail.
-//
-type fileLoader struct {
+type FileLoader struct {
 	// Loader that spawned this loader.
 	// Used to avoid cycles.
-	referrer *fileLoader
+	referrer *FileLoader
 
 	// An absolute, cleaned path to a directory.
 	// The Load function will read non-absolute
@@ -107,23 +106,9 @@ type fileLoader struct {
 	cleaner func() error
 }
 
-// NewFileLoaderAtCwd returns a loader that loads from PWD.
-// A convenience for kustomize edit commands.
-func NewFileLoaderAtCwd(fSys filesys.FileSystem) *fileLoader {
-	return newLoaderOrDie(
-		RestrictionRootOnly, fSys, filesys.SelfDir)
-}
-
-// NewFileLoaderAtRoot returns a loader that loads from "/".
-// A convenience for tests.
-func NewFileLoaderAtRoot(fSys filesys.FileSystem) *fileLoader {
-	return newLoaderOrDie(
-		RestrictionRootOnly, fSys, filesys.Separator)
-}
-
 // Repo returns the absolute path to the repo that contains Root if this fileLoader was created from a url
 // or the empty string otherwise.
-func (fl *fileLoader) Repo() string {
+func (fl *FileLoader) Repo() string {
 	if fl.repoSpec != nil {
 		return fl.repoSpec.Dir.String()
 	}
@@ -132,13 +117,13 @@ func (fl *fileLoader) Repo() string {
 
 // Root returns the absolute path that is prepended to any
 // relative paths used in Load.
-func (fl *fileLoader) Root() string {
+func (fl *FileLoader) Root() string {
 	return fl.root.String()
 }
 
-func newLoaderOrDie(
+func NewLoaderOrDie(
 	lr LoadRestrictorFunc,
-	fSys filesys.FileSystem, path string) *fileLoader {
+	fSys filesys.FileSystem, path string) *FileLoader {
 	root, err := filesys.ConfirmDir(fSys, path)
 	if err != nil {
 		log.Fatalf("unable to make loader at '%s'; %v", path, err)
@@ -147,12 +132,12 @@ func newLoaderOrDie(
 		lr, root, fSys, nil, git.ClonerUsingGitExec)
 }
 
-// newLoaderAtConfirmedDir returns a new fileLoader with given root.
+// newLoaderAtConfirmedDir returns a new FileLoader with given root.
 func newLoaderAtConfirmedDir(
 	lr LoadRestrictorFunc,
 	root filesys.ConfirmedDir, fSys filesys.FileSystem,
-	referrer *fileLoader, cloner git.Cloner) *fileLoader {
-	return &fileLoader{
+	referrer *FileLoader, cloner git.Cloner) *FileLoader {
+	return &FileLoader{
 		loadRestrictor: lr,
 		root:           root,
 		referrer:       referrer,
@@ -164,7 +149,7 @@ func newLoaderAtConfirmedDir(
 
 // New returns a new Loader, rooted relative to current loader,
 // or rooted in a temp directory holding a git repo clone.
-func (fl *fileLoader) New(path string) (ifc.Loader, error) {
+func (fl *FileLoader) New(path string) (ifc.Loader, error) {
 	if path == "" {
 		return nil, errors.Errorf("new root cannot be empty")
 	}
@@ -200,7 +185,7 @@ func (fl *fileLoader) New(path string) (ifc.Loader, error) {
 // directory holding a cloned git repo.
 func newLoaderAtGitClone(
 	repoSpec *git.RepoSpec, fSys filesys.FileSystem,
-	referrer *fileLoader, cloner git.Cloner) (ifc.Loader, error) {
+	referrer *FileLoader, cloner git.Cloner) (ifc.Loader, error) {
 	cleaner := repoSpec.Cleaner(fSys)
 	err := cloner(repoSpec)
 	if err != nil {
@@ -229,7 +214,7 @@ func newLoaderAtGitClone(
 		return nil, fmt.Errorf("%q refers to directory outside of repo %q", repoSpec.AbsPath(),
 			repoSpec.CloneDir())
 	}
-	return &fileLoader{
+	return &FileLoader{
 		// Clones never allowed to escape root.
 		loadRestrictor: RestrictionRootOnly,
 		root:           root,
@@ -241,7 +226,7 @@ func newLoaderAtGitClone(
 	}, nil
 }
 
-func (fl *fileLoader) errIfGitContainmentViolation(
+func (fl *FileLoader) errIfGitContainmentViolation(
 	base filesys.ConfirmedDir) error {
 	containingRepo := fl.containingRepo()
 	if containingRepo == nil {
@@ -259,7 +244,7 @@ func (fl *fileLoader) errIfGitContainmentViolation(
 
 // Looks back through referrers for a git repo, returning nil
 // if none found.
-func (fl *fileLoader) containingRepo() *git.RepoSpec {
+func (fl *FileLoader) containingRepo() *git.RepoSpec {
 	if fl.repoSpec != nil {
 		return fl.repoSpec
 	}
@@ -271,7 +256,7 @@ func (fl *fileLoader) containingRepo() *git.RepoSpec {
 
 // errIfArgEqualOrHigher tests whether the argument,
 // is equal to or above the root of any ancestor.
-func (fl *fileLoader) errIfArgEqualOrHigher(
+func (fl *FileLoader) errIfArgEqualOrHigher(
 	candidateRoot filesys.ConfirmedDir) error {
 	if fl.root.HasPrefix(candidateRoot) {
 		return fmt.Errorf(
@@ -288,7 +273,7 @@ func (fl *fileLoader) errIfArgEqualOrHigher(
 // I.e. Allow a distinction between git URI with
 // path foo and tag bar and a git URI with the same
 // path but a different tag?
-func (fl *fileLoader) errIfRepoCycle(newRepoSpec *git.RepoSpec) error {
+func (fl *FileLoader) errIfRepoCycle(newRepoSpec *git.RepoSpec) error {
 	// TODO(monopole): Use parsed data instead of Raw().
 	if fl.repoSpec != nil &&
 		strings.HasPrefix(fl.repoSpec.Raw(), newRepoSpec.Raw()) {
@@ -305,7 +290,7 @@ func (fl *fileLoader) errIfRepoCycle(newRepoSpec *git.RepoSpec) error {
 // Load returns the content of file at the given path,
 // else an error. Relative paths are taken relative
 // to the root.
-func (fl *fileLoader) Load(path string) ([]byte, error) {
+func (fl *FileLoader) Load(path string) ([]byte, error) {
 	if IsRemoteFile(path) {
 		return fl.httpClientGetContent(path)
 	}
@@ -319,7 +304,7 @@ func (fl *fileLoader) Load(path string) ([]byte, error) {
 	return fl.fSys.ReadFile(path)
 }
 
-func (fl *fileLoader) httpClientGetContent(path string) ([]byte, error) {
+func (fl *FileLoader) httpClientGetContent(path string) ([]byte, error) {
 	var hc *http.Client
 	if fl.http != nil {
 		hc = fl.http
@@ -344,6 +329,6 @@ func (fl *fileLoader) httpClientGetContent(path string) ([]byte, error) {
 }
 
 // Cleanup runs the cleaner.
-func (fl *fileLoader) Cleanup() error {
+func (fl *FileLoader) Cleanup() error {
 	return fl.cleaner()
 }

api/internal/loader/fileloader_test.go

@@ -31,6 +31,11 @@ func TestIsRemoteFile(t *testing.T) {
 			"https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/examples/helloWorld/configMap.yaml",
 			true,
 		},
+		"malformed https": {
+			// TODO(annasong): Maybe we want to fix this. Needs more research.
+			"https:/raw.githubusercontent.com/kubernetes-sigs/kustomize/master/examples/helloWorld/configMap.yaml",
+			true,
+		},
 		"https dir": {
 			"https://github.com/kubernetes-sigs/kustomize//examples/helloWorld/",
 			true,
@@ -88,8 +93,9 @@ func MakeFakeFs(td []testData) filesys.FileSystem {
 	return fSys
 }
 
-func makeLoader() *fileLoader {
-	return NewFileLoaderAtRoot(MakeFakeFs(testCases))
+func makeLoader() *FileLoader {
+	return NewLoaderOrDie(
+		RestrictionRootOnly, MakeFakeFs(testCases), filesys.Separator)
 }
 
 func TestLoaderLoad(t *testing.T) {
@@ -201,23 +207,44 @@ func TestNewEmptyLoader(t *testing.T) {
 	require.Error(t, err)
 }
 
-func TestNewLoaderHTTP(t *testing.T) {
-	t.Run("doesn't exist", func(t *testing.T) {
-		_, err := makeLoader().New("https://google.com/project")
-		require.Error(t, err)
-	})
-	// Though it is unlikely and we do not weigh this use case in our designs,
-	// it is possible for a reference that is considered a remote file to
-	// actually be a directory
-	t.Run("exists", func(t *testing.T) {
-		const remoteFileLikeRoot = "https://domain"
-		require.True(t, IsRemoteFile(remoteFileLikeRoot))
+func TestNewRemoteLoaderDoesNotExist(t *testing.T) {
+	_, err := makeLoader().New("https://example.com/org/repo")
+	require.ErrorContains(t, err, "fetch")
+}
+
+func TestLoaderLocalScheme(t *testing.T) {
+	// It is unlikely but possible for a reference with a url scheme to
+	// actually refer to a local file or directory.
+	t.Run("file", func(t *testing.T) {
 		fSys, dir := setupOnDisk(t)
-		require.NoError(t, fSys.MkdirAll(dir.Join("https:/domain")))
-		ldr, err := newLoaderOrDie(RestrictionRootOnly,
+		parts := []string{
+			"ssh:",
+			"resource.yaml",
+		}
+		require.NoError(t, fSys.Mkdir(dir.Join(parts[0])))
+		const content = "resource config"
+		require.NoError(t, fSys.WriteFile(
+			dir.Join(filepath.Join(parts...)),
+			[]byte(content),
+		))
+		actualContent, err := NewLoaderOrDie(RestrictionRootOnly,
 			fSys,
 			dir.String(),
-		).New(remoteFileLikeRoot)
+		).Load(strings.Join(parts, "//"))
+		require.NoError(t, err)
+		require.Equal(t, content, string(actualContent))
+	})
+	t.Run("directory", func(t *testing.T) {
+		fSys, dir := setupOnDisk(t)
+		parts := []string{
+			"https:",
+			"root",
+		}
+		require.NoError(t, fSys.MkdirAll(dir.Join(filepath.Join(parts...))))
+		ldr, err := NewLoaderOrDie(RestrictionRootOnly,
+			fSys,
+			dir.String(),
+		).New(strings.Join(parts, "//"))
 		require.NoError(t, err)
 		require.Empty(t, ldr.Repo())
 	})
@@ -296,7 +323,7 @@ func TestRestrictionRootOnlyInRealLoader(t *testing.T) {
 
 	var l ifc.Loader
 
-	l = newLoaderOrDie(RestrictionRootOnly, fSys, dir)
+	l = NewLoaderOrDie(RestrictionRootOnly, fSys, dir)
 
 	l = doSanityChecksAndDropIntoBase(t, l)
 
@@ -317,7 +344,7 @@ func TestRestrictionNoneInRealLoader(t *testing.T) {
 
 	var l ifc.Loader
 
-	l = newLoaderOrDie(RestrictionNone, fSys, dir)
+	l = NewLoaderOrDie(RestrictionNone, fSys, dir)
 
 	l = doSanityChecksAndDropIntoBase(t, l)
 
@@ -416,7 +443,7 @@ func TestLoaderDisallowsLocalBaseFromRemoteOverlay(t *testing.T) {
 
 	// Establish that a local overlay can navigate
 	// to the local bases.
-	l1 = newLoaderOrDie(
+	l1 = NewLoaderOrDie(
 		RestrictionRootOnly, fSys, cloneRoot+"/foo/overlay")
 	require.Equal(cloneRoot+"/foo/overlay", l1.Root())
 
@@ -574,7 +601,8 @@ func TestLoaderHTTP(t *testing.T) {
 		},
 	}
 
-	l1 := NewFileLoaderAtRoot(MakeFakeFs(testCasesFile))
+	l1 := NewLoaderOrDie(
+		RestrictionRootOnly, MakeFakeFs(testCasesFile), filesys.Separator)
 	require.Equal("/", l1.Root())
 
 	for _, x := range testCasesFile {
@@ -635,6 +663,8 @@ func TestLoaderHTTP(t *testing.T) {
 
 // setupOnDisk sets up a file system on disk and directory that is cleaned after
 // test completion.
+// TODO(annasong): Move all loader tests that require real file system into
+// api/krusty.
 func setupOnDisk(t *testing.T) (filesys.FileSystem, filesys.ConfirmedDir) {
 	t.Helper()
 

api/internal/localizer/localizer.go

@@ -11,8 +11,8 @@ import (
 
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/generators"
+	"sigs.k8s.io/kustomize/api/internal/loader"
 	"sigs.k8s.io/kustomize/api/internal/target"
-	"sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"

api/internal/localizer/locloader.go

@@ -8,7 +8,7 @@ import (
 
 	"sigs.k8s.io/kustomize/api/ifc"
 	"sigs.k8s.io/kustomize/api/internal/git"
-	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/internal/loader"
 	"sigs.k8s.io/kustomize/kyaml/errors"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )

api/internal/plugins/builtinconfig/loaddefaultconfig_test.go

@@ -7,7 +7,7 @@ import (
 	"reflect"
 	"testing"
 
-	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/internal/loader"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 	"sigs.k8s.io/kustomize/kyaml/resid"

api/internal/plugins/builtinconfig/namebackreferences.go

@@ -47,6 +47,8 @@ type NameBackReferences struct {
 	// TODO: rename json 'fieldSpecs' to 'referrers' for clarity.
 	// This will, however, break anyone using a custom config.
 	Referrers types.FsSlice `json:"fieldSpecs,omitempty" yaml:"fieldSpecs,omitempty"`
+
+	// Note: If any new pointer based members are added, DeepCopy needs to be updated
 }
 
 func (n NameBackReferences) String() string {
@@ -66,6 +68,17 @@ func (s nbrSlice) Less(i, j int) bool {
 	return s[i].Gvk.IsLessThan(s[j].Gvk)
 }
 
+// DeepCopy returns a new copy of nbrSlice
+func (s nbrSlice) DeepCopy() nbrSlice {
+	ret := make(nbrSlice, len(s))
+	copy(ret, s)
+	for i, slice := range ret {
+		ret[i].Referrers = slice.Referrers.DeepCopy()
+	}
+
+	return ret
+}
+
 func (s nbrSlice) mergeAll(o nbrSlice) (result nbrSlice, err error) {
 	result = s
 	for _, r := range o {

api/internal/plugins/builtinconfig/namebackreferences_test.go

@@ -95,3 +95,29 @@ func TestMergeAll(t *testing.T) {
 		t.Fatalf("expected\n %v\n but got\n %v\n", expected, actual)
 	}
 }
+
+func TestNbrSlice_DeepCopy(t *testing.T) {
+	original := make(nbrSlice, 2, 4)
+	original[0] = NameBackReferences{Gvk: resid.FromKind("A"), Referrers: types.FsSlice{{Path: "a"}}}
+	original[1] = NameBackReferences{Gvk: resid.FromKind("B"), Referrers: types.FsSlice{{Path: "b"}}}
+
+	copied := original.DeepCopy()
+
+	original, _ = original.mergeOne(NameBackReferences{Gvk: resid.FromKind("C"), Referrers: types.FsSlice{{Path: "c"}}})
+
+	// perform mutations which should not affect original
+	copied.Swap(0, 1)
+	copied[0].Referrers[0].Path = "very b" // ensure Referrers are not shared
+	_, _ = copied.mergeOne(NameBackReferences{Gvk: resid.FromKind("D"), Referrers: types.FsSlice{{Path: "d"}}})
+
+	// if DeepCopy does not work, original would be {very b,a,d} instead of {a,b,c}
+	expected := nbrSlice{
+		{Gvk: resid.FromKind("A"), Referrers: types.FsSlice{{Path: "a"}}},
+		{Gvk: resid.FromKind("B"), Referrers: types.FsSlice{{Path: "b"}}},
+		{Gvk: resid.FromKind("C"), Referrers: types.FsSlice{{Path: "c"}}},
+	}
+
+	if !reflect.DeepEqual(original, expected) {
+		t.Fatalf("original affected by mutations to copied object:\ngot\t%+v,\nexpected: %+v", original, expected)
+	}
+}

api/internal/plugins/builtinconfig/transformerconfig.go

@@ -6,15 +6,17 @@ package builtinconfig
 import (
 	"log"
 	"sort"
+	"sync"
 
 	"sigs.k8s.io/kustomize/api/ifc"
-	"sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts"
+	"sigs.k8s.io/kustomize/api/internal/konfig/builtinpluginconsts"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/errors"
 )
 
 // TransformerConfig holds the data needed to perform transformations.
 type TransformerConfig struct {
+	// if any fields are added, update the DeepCopy implementation
 	NamePrefix        types.FsSlice `json:"namePrefix,omitempty" yaml:"namePrefix,omitempty"`
 	NameSuffix        types.FsSlice `json:"nameSuffix,omitempty" yaml:"nameSuffix,omitempty"`
 	NameSpace         types.FsSlice `json:"namespace,omitempty" yaml:"namespace,omitempty"`
@@ -32,14 +34,43 @@ func MakeEmptyConfig() *TransformerConfig {
 	return &TransformerConfig{}
 }
 
+// DeepCopy returns a new copy of TransformerConfig
+func (t *TransformerConfig) DeepCopy() *TransformerConfig {
+	return &TransformerConfig{
+		NamePrefix:        t.NamePrefix.DeepCopy(),
+		NameSuffix:        t.NameSuffix.DeepCopy(),
+		NameSpace:         t.NameSpace.DeepCopy(),
+		CommonLabels:      t.CommonLabels.DeepCopy(),
+		TemplateLabels:    t.TemplateLabels.DeepCopy(),
+		CommonAnnotations: t.CommonAnnotations.DeepCopy(),
+		NameReference:     t.NameReference.DeepCopy(),
+		VarReference:      t.VarReference.DeepCopy(),
+		Images:            t.Images.DeepCopy(),
+		Replicas:          t.Replicas.DeepCopy(),
+	}
+}
+
+// the default transformer config is initialized by MakeDefaultConfig,
+// and must only be accessed via that function.
+var (
+	initDefaultConfig sync.Once          //nolint:gochecknoglobals
+	defaultConfig     *TransformerConfig //nolint:gochecknoglobals
+)
+
 // MakeDefaultConfig returns a default TransformerConfig.
 func MakeDefaultConfig() *TransformerConfig {
-	c, err := makeTransformerConfigFromBytes(
-		builtinpluginconsts.GetDefaultFieldSpecs())
-	if err != nil {
-		log.Fatalf("Unable to make default transformconfig: %v", err)
-	}
-	return c
+	// parsing is expensive when having a large tree with many kustomization modules, so only do it once
+	initDefaultConfig.Do(func() {
+		var err error
+		defaultConfig, err = makeTransformerConfigFromBytes(
+			builtinpluginconsts.GetDefaultFieldSpecs())
+		if err != nil {
+			log.Fatalf("Unable to make default transformconfig: %v", err)
+		}
+	})
+
+	// return a copy to avoid any mutations to protect the reference copy
+	return defaultConfig.DeepCopy()
 }
 
 // MakeTransformerConfig returns a merger of custom config,

api/internal/plugins/builtinconfig/transformerconfig_test.go

@@ -173,3 +173,22 @@ func TestMerge(t *testing.T) {
 		t.Fatalf("expected: %v\n but got: %v\n", cfga, actual)
 	}
 }
+
+func TestMakeDefaultConfig_mutation(t *testing.T) {
+	a := MakeDefaultConfig()
+
+	// mutate
+	a.NameReference[0].Kind = "mutated"
+	a.NameReference = a.NameReference[:1]
+
+	clean := MakeDefaultConfig()
+	if clean.NameReference[0].Kind == "mutated" {
+		t.Errorf("MakeDefaultConfig() did not return a clean copy: %+v", clean.NameReference)
+	}
+}
+
+func BenchmarkMakeDefaultConfig(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		_ = MakeDefaultConfig()
+	}
+}

api/internal/plugins/execplugin/execplugin_test.go

@@ -10,10 +10,10 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	fLdr "sigs.k8s.io/kustomize/api/internal/loader"
 	. "sigs.k8s.io/kustomize/api/internal/plugins/execplugin"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/internal/plugins/utils"
-	fLdr "sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"

api/internal/plugins/loader/loader_test.go

@@ -7,8 +7,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/kustomize/api/internal/loader"
 	. "sigs.k8s.io/kustomize/api/internal/plugins/loader"
-	"sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"

api/internal/plugins/utils/utils_test.go

@@ -53,7 +53,7 @@ func makeConfigMap(rf *resource.Factory, name, behavior string, hashValue *strin
 	return r
 }
 
-func makeConfigMapOptions(rf *resource.Factory, name, behavior string, disableHash bool) *resource.Resource {
+func makeConfigMapOptions(rf *resource.Factory, name, behavior string, disableHash bool) (*resource.Resource, error) {
 	return rf.FromMapAndOption(map[string]interface{}{
 		"apiVersion": "v1",
 		"kind":       "ConfigMap",
@@ -89,7 +89,11 @@ func TestUpdateResourceOptions(t *testing.T) {
 		name := fmt.Sprintf("test%d", i)
 		err := in.Append(makeConfigMap(rf, name, c.behavior, c.hashValue))
 		require.NoError(t, err)
-		err = expected.Append(makeConfigMapOptions(rf, name, c.behavior, !c.needsHash))
+		config, err := makeConfigMapOptions(rf, name, c.behavior, !c.needsHash)
+		if err != nil {
+			t.Errorf("expected new instance with an options but got error: %v", err)
+		}
+		err = expected.Append(config)
 		require.NoError(t, err)
 	}
 	actual, err := UpdateResourceOptions(in)

api/internal/target/kusttarget.go

@@ -13,12 +13,12 @@ import (
 	"sigs.k8s.io/kustomize/api/internal/accumulator"
 	"sigs.k8s.io/kustomize/api/internal/builtins"
 	"sigs.k8s.io/kustomize/api/internal/kusterr"
+	load "sigs.k8s.io/kustomize/api/internal/loader"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinconfig"
 	"sigs.k8s.io/kustomize/api/internal/plugins/builtinhelpers"
 	"sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/konfig"
-	load "sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"

api/internal/target/kusttarget_test.go

@@ -13,7 +13,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"sigs.k8s.io/kustomize/api/ifc"
 	. "sigs.k8s.io/kustomize/api/internal/target"
-	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/pkg/loader"
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/resource"

api/internal/target/maker_test.go

@@ -6,9 +6,9 @@ package target_test
 import (
 	"testing"
 
+	fLdr "sigs.k8s.io/kustomize/api/internal/loader"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/internal/target"
-	fLdr "sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"

api/internal/utils/timedcall.go

@@ -10,7 +10,7 @@ import (
 // TimedCall runs fn, failing if it doesn't complete in the given duration.
 // The description is used in the timeout error message.
 func TimedCall(description string, d time.Duration, fn func() error) error {
-	done := make(chan error)
+	done := make(chan error, 1)
 	timer := time.NewTimer(d)
 	defer timer.Stop()
 	go func() { done <- fn() }()

api/internal/utils/timedcall_test.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/goleak"
 	. "sigs.k8s.io/kustomize/api/internal/utils"
 )
 
@@ -62,3 +63,20 @@ func TestTimedCallSlowWithError(t *testing.T) {
 		t.Fail()
 	}
 }
+
+func TestTimedCallGoroutineLeak(t *testing.T) {
+	defer goleak.VerifyNone(t)
+	err := TimedCall("function done, no goroutine leaks", timeToWait, func() error {
+		time.Sleep(tooSlow)
+		return fmt.Errorf("function done")
+	})
+	if assert.Error(t, err) {
+		assert.EqualError(t, err, errMsg("function done, no goroutine leaks"))
+	} else {
+		t.Fail()
+	}
+
+	// The code introduces a 2-second sleep to allow the goroutine to complete its execution.
+	// Subsequently, it verifies if the goroutine created by the function exits as expected.
+	time.Sleep(tooSlow)
+}

api/krusty/accumulation_test.go

@@ -17,6 +17,18 @@ import (
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 )
 
+const validResource = `
+apiVersion: v1
+kind: Service
+metadata:
+  name: myService
+spec:
+  selector:
+    backend: bungie
+  ports:
+    - port: 7002
+`
+
 func TestTargetMustHaveKustomizationFile(t *testing.T) {
 	th := kusttest_test.MakeHarness(t)
 	th.WriteF("service.yaml", `
@@ -63,17 +75,7 @@ func TestBaseMustHaveKustomizationFile(t *testing.T) {
 resources:
 - base
 `)
-	th.WriteF("base/service.yaml", `
-apiVersion: v1
-kind: Service
-metadata:
-  name: myService
-spec:
-  selector:
-    backend: bungie
-  ports:
-    - port: 7002
-`)
+	th.WriteF("base/service.yaml", validResource)
 	err := th.RunWithErr(".", th.MakeDefaultOptions())
 	if err == nil {
 		t.Fatalf("expected an error")
@@ -167,12 +169,35 @@ spec:
 
 func TestAccumulateResourcesErrors(t *testing.T) {
 	type testcase struct {
-		name     string
-		resource string
-		// regex error message that is output when kustomize tries to
-		// accumulate resource as file and dir, respectively
+		name       string
+		resource   string
+		isAbsolute bool
+		files      map[string]string
+		// errFile, errDir are regex for the expected error message output
+		// when kustomize tries to accumulate resource as file and dir,
+		// respectively. The test substitutes occurrences of "%s" in the
+		// error strings with the absolute path where kustomize looks for it.
 		errFile, errDir string
 	}
+	populateAbsolutePaths := func(tc testcase, dir string) testcase {
+		filePaths := make(map[string]string, len(tc.files)+1)
+		for file, content := range tc.files {
+			filePaths[filepath.Join(dir, file)] = content
+		}
+		resourcePath := filepath.Join(dir, tc.resource)
+		if tc.isAbsolute {
+			tc.resource = resourcePath
+		}
+		filePaths[filepath.Join(dir, "kustomization.yaml")] = fmt.Sprintf(`
+resources:
+- %s
+`, tc.resource)
+		tc.files = filePaths
+		regPath := regexp.QuoteMeta(resourcePath)
+		tc.errFile = strings.ReplaceAll(tc.errFile, "%s", regPath)
+		tc.errDir = strings.ReplaceAll(tc.errDir, "%s", regPath)
+		return tc
+	}
 	buildError := func(tc testcase) string {
 		const (
 			prefix            = "accumulating resources"
@@ -196,39 +221,89 @@ func TestAccumulateResourcesErrors(t *testing.T) {
 	for _, test := range []testcase{
 		{
 			name: "remote file not considered repo",
-			// This url is too short to be considered a remote repo.
-			resource: "https://raw.githubusercontent.com/kustomize",
-			// It is acceptable that the error for a remote file-like reference
-			// (that is not long enough to be considered a repo) does not
-			// indicate said reference is not a local directory.
-			// Though it is possible for the remote file-like reference to be
-			// a local directory, it is very unlikely.
-			errFile: `HTTP Error: status code 400 \(Bad Request\)\z`,
+			// The example.com second-level domain is reserved and
+			// safe to access, see RFC 2606.
+			resource: "https://example.com/segments-too-few-to-be-repo",
+			// It's acceptable for the error output of a remote file-like
+			// resource to not indicate the resource's status as a
+			// local directory. Though it is possible for a remote file-like
+			// resource to be a local directory, it is very unlikely.
+			errFile: `HTTP Error: status code 404 \(Not Found\)\z`,
 		},
 		{
 			name:     "remote file qualifies as repo",
-			resource: "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/kustomize/v5.0.0/examples/helloWorld/configMap",
+			resource: "https://example.com/long/enough/to/have/org/and/repo",
 			// TODO(4788): This error message is technically wrong. Just
-			// because we fail to GET a reference does not mean the reference is
-			// not a remote file. We should return the GET status code instead.
+			// because we fail to GET a resource does not mean the resource is
+			// not a remote file. We should return the GET status code as well.
 			errFile: "URL is a git repository",
 			errDir:  `failed to run \S+/git fetch --depth=1 .+`,
 		},
+		{
+			name: "local file qualifies as repo",
+			// The .example top level domain is reserved for example purposes,
+			// see RFC 2606.
+			resource: "package@v1.28.0.example/configs/base",
+			errFile:  `evalsymlink failure on '%s' .+`,
+			errDir:   `failed to run \S+/git fetch --depth=1 .+`,
+		},
+		{
+			name:     "relative path does not exist",
+			resource: "file-or-directory",
+			errFile:  `evalsymlink failure on '%s' .+`,
+			errDir:   `must build at directory: not a valid directory: evalsymlink failure .+`,
+		},
+		{
+			name:       "absolute path does not exist",
+			resource:   "file-or-directory",
+			isAbsolute: true,
+			errFile:    `evalsymlink failure on '%s' .+`,
+			errDir:     `new root '%s' cannot be absolute`,
+		},
+		{
+			name:     "relative file violates restrictions",
+			resource: "../base/resource.yaml",
+			files: map[string]string{
+				"../base/resource.yaml": validResource,
+			},
+			errFile: "security; file '%s' is not in or below .+",
+			// TODO(4348): Over-inclusion of directory error message when we
+			// know resource is file.
+			errDir: "must build at directory: '%s': file is not directory",
+		},
+		{
+			name:       "absolute file violates restrictions",
+			resource:   "../base/resource.yaml",
+			isAbsolute: true,
+			files: map[string]string{
+				"../base/resource.yaml": validResource,
+			},
+			errFile: "security; file '%s' is not in or below .+",
+			// TODO(4348): Over-inclusion of directory error message when we
+			// know resource is file.
+			errDir: `new root '%s' cannot be absolute`,
+		},
 	} {
 		t.Run(test.name, func(t *testing.T) {
-			// should use real file system to indicate that we are creating
-			// new temporary directories on disk when we attempt to fetch repos
-			fSys, tmpDir := kusttest_test.CreateKustDir(t, fmt.Sprintf(`
-resources:
-- %s
-`, test.resource))
+			// Should use real file system to indicate that we are creating
+			// new temporary directories on disk when we attempt to fetch repos.
+			fs, tmpDir := kusttest_test.Setup(t)
+			root := tmpDir.Join("root")
+			require.NoError(t, fs.Mkdir(root))
+
+			test = populateAbsolutePaths(test, root)
+			for file, content := range test.files {
+				dir := filepath.Dir(file)
+				require.NoError(t, fs.MkdirAll(dir))
+				require.NoError(t, fs.WriteFile(file, []byte(content)))
+			}
+
 			b := krusty.MakeKustomizer(krusty.MakeDefaultOptions())
-			_, err := b.Run(fSys, tmpDir.String())
+			_, err := b.Run(fs, root)
 			require.Regexp(t, buildError(test), err.Error())
 		})
 	}
 	// TODO(annasong): add tests that check accumulateResources errors for
-	// - local files
 	// - repos
 	// - local directories
 	// - files that yield malformed yaml errors

api/krusty/component_test.go

@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
+	"sigs.k8s.io/kustomize/api/internal/loader"
 	"sigs.k8s.io/kustomize/api/konfig"
-	"sigs.k8s.io/kustomize/api/loader"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 )
 

api/krusty/fnplugin_test.go

@@ -15,6 +15,10 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
+const (
+	repoRootDir = "../../"
+)
+
 const generateDeploymentDotSh = `#!/bin/sh
 
 cat <<EOF
@@ -513,51 +517,58 @@ func TestFnContainerGenerator(t *testing.T) {
 resources:
 - deployment.yaml
 generators:
-- project-service-set.yaml
+- service-set.yaml
 `)
 	// Create generator config
-	th.WriteF(filepath.Join(tmpDir.String(), "project-service-set.yaml"), `
-apiVersion: blueprints.cloud.google.com/v1alpha1
-kind: ProjectServiceSet
+	th.WriteF(filepath.Join(tmpDir.String(), "service-set.yaml"), `
+apiVersion: kustomize.sigs.k8s.io/v1alpha1
+kind: ServiceGenerator
 metadata:
-  name: demo
+  name: simplegenerator
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: gcr.io/kpt-fn/enable-gcp-services:v0.1.0
+        image: gcr.io/kustomize-functions/e2econtainersimplegenerator
 spec:
-  services:
-    - compute.googleapis.com
-  projectID: foo
+  port: 8081
 `)
 	// Create another resource just to make sure everything is added
 	th.WriteF(filepath.Join(tmpDir.String(), "deployment.yaml"), `
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: foo
+  name: simplegenerator
 `)
+
+	build := exec.Command("docker", "build", ".",
+		"-f", "./cmd/config/internal/commands/e2e/e2econtainersimplegenerator/Dockerfile",
+		"-t", "gcr.io/kustomize-functions/e2econtainersimplegenerator",
+	)
+	build.Dir = repoRootDir
+	assert.NoError(t, build.Run())
+
 	m := th.Run(tmpDir.String(), o)
 	actual, err := m.AsYaml()
 	assert.NoError(t, err)
 	assert.Equal(t, `apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: foo
+  name: simplegenerator
 ---
-apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
+apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    blueprints.cloud.google.com/ownerReference: blueprints.cloud.google.com/ProjectServiceSet/demo
-    config.kubernetes.io/function: |
-      container:
-        image: gcr.io/kpt-fn/enable-gcp-services:v0.1.0
-  name: demo-compute
+  labels:
+    app: simplegenerator
+  name: simplegenerator-svc
 spec:
-  projectRef:
-    external: foo
-  resourceID: compute.googleapis.com
+  ports:
+  - name: http
+    port: 8081
+    protocol: TCP
+    targetPort: 8081
+  selector:
+    app: simplegenerator
 `, string(actual))
 }
 
@@ -593,7 +604,7 @@ metadata:
 		"-f", "./cmd/config/internal/commands/e2e/e2econtainerconfig/Dockerfile",
 		"-t", "gcr.io/kustomize-functions/e2econtainerconfig",
 	)
-	build.Dir = "../../" // Repo root
+	build.Dir = repoRootDir
 	assert.NoError(t, build.Run())
 	m := th.Run(tmpDir.String(), o)
 	actual, err := m.AsYaml()
@@ -611,6 +622,12 @@ metadata:
 
 func TestFnContainerTransformerWithConfig(t *testing.T) {
 	skipIfNoDocker(t)
+	//https://docs.docker.com/engine/reference/commandline/build/#git-repositories
+	build := exec.Command("docker", "build", "https://github.com/GoogleContainerTools/kpt-functions-sdk.git#go-sdk-v0.0.1:ts/hello-world",
+		"-f", "build/label_namespace.Dockerfile",
+		"-t", "gcr.io/kpt-functions/label-namespace:go-sdk-v0.0.1",
+	)
+	assert.NoError(t, build.Run())
 	th := kusttest_test.MakeHarness(t)
 	o := th.MakeOptionsPluginsEnabled()
 	fSys := filesys.MakeFsOnDisk()
@@ -644,7 +661,7 @@ metadata:
   annotations:
     config.kubernetes.io/function: |-
       container:
-        image: gcr.io/kpt-functions/label-namespace@sha256:4f030738d6d25a207641ca517916431517578bd0eb8d98a8bde04e3bb9315dcd
+        image: gcr.io/kpt-functions/label-namespace:go-sdk-v0.0.1
 data:
   label_name: my-ns-name
   label_value: function-test
@@ -684,25 +701,31 @@ generators:
 - gener.yaml
 `)))
 	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "gener.yaml"), []byte(`
-apiVersion: v1
-kind: ConfigMap
+apiVersion: kustomize.sigs.k8s.io/v1alpha1
+kind: EnvTemplateGenerator
 metadata:
-  name: demo
+  name: e2econtainerenvgenerator
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: quay.io/aodinokov/kpt-templater:0.0.1
+        image: gcr.io/kustomize-functions/e2econtainerenvgenerator
         envs:
         - TESTTEMPLATE=value
-data:
-  template: |
-    apiVersion: v1
-    kind: ConfigMap
-    metadata:
-      name: env
-    data:
-      value: '{{ env "TESTTEMPLATE" }}'
+template: |
+  apiVersion: v1
+  kind: ConfigMap
+  metadata:
+    name: env
+  data:
+    value: %q
 `)))
+	build := exec.Command("docker", "build", ".",
+		"-f", "./cmd/config/internal/commands/e2e/e2econtainerenvgenerator/Dockerfile",
+		"-t", "gcr.io/kustomize-functions/e2econtainerenvgenerator",
+	)
+	build.Dir = repoRootDir
+	assert.NoError(t, build.Run())
+
 	m, err := b.Run(
 		fSys,
 		tmpDir.String())
@@ -731,44 +754,36 @@ generators:
 - gener.yaml
 `)))
 	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "gener.yaml"), []byte(`
-apiVersion: v1alpha1
+apiVersion: kustomize.sigs.k8s.io/v1alpha1
 kind: RenderHelmChart
 metadata:
   name: demo
   annotations:
     config.kubernetes.io/function: |
       container:
-        image: gcr.io/kpt-fn/render-helm-chart:v0.1.0
+        image: gcr.io/kustomize-functions/e2econtainermountbind
         mounts:
         - type: "bind"
-          src: "./charts"
-          dst: "/tmp/charts"
-helmCharts:
-- name: helloworld-chart
-  releaseName: test
-  valuesFile: /tmp/charts/helloworld-values/values.yaml
+          src: "./yaml"
+          dst: "/tmp/yaml"
+path: /tmp/yaml/resources.yaml
 `)))
-	assert.NoError(t, fSys.MkdirAll(filepath.Join(tmpDir.String(), "charts", "helloworld-chart", "templates")))
-	assert.NoError(t, fSys.MkdirAll(filepath.Join(tmpDir.String(), "charts", "helloworld-values")))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "charts", "helloworld-chart", "Chart.yaml"), []byte(`
-apiVersion: v2
-name: helloworld-chart
-description: A Helm chart for Kubernetes
-type: application
-version: 0.1.0
-appVersion: 1.16.0
-`)))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "charts", "helloworld-chart", "templates", "deployment.yaml"), []byte(`
+	assert.NoError(t, fSys.MkdirAll(filepath.Join(tmpDir.String(), "yaml", "tmp")))
+	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "yaml", "resources.yaml"), []byte(`
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: name
 spec:
-  replicas: {{ .Values.replicaCount }}
-`)))
-	assert.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "charts", "helloworld-values", "values.yaml"), []byte(`
-replicaCount: 5
+  replicas: 3
 `)))
+	build := exec.Command("docker", "build", ".",
+		"-f", "./cmd/config/internal/commands/e2e/e2econtainermountbind/Dockerfile",
+		"-t", "gcr.io/kustomize-functions/e2econtainermountbind",
+	)
+	build.Dir = repoRootDir
+	assert.NoError(t, build.Run())
+
 	m, err := b.Run(
 		fSys,
 		tmpDir.String())
@@ -780,7 +795,7 @@ kind: Deployment
 metadata:
   name: name
 spec:
-  replicas: 5
+  replicas: 3
 `, string(actual))
 }
 

api/krusty/helmchartinflationgenerator_test.go

@@ -12,7 +12,8 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/copyutil"
 )
 
-const expectedHelm = `
+const (
+	expectedHelm = `
 apiVersion: v1
 data:
   rcon-password: Q0hBTkdFTUUh
@@ -46,6 +47,98 @@ spec:
   type: ClusterIP
 `
 
+	expectedHelmExternalDNS = `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/instance: test
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: external-dns
+    helm.sh/chart: external-dns-6.19.2
+  name: test-external-dns
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: test
+      app.kubernetes.io/name: external-dns
+  template:
+    metadata:
+      annotations: null
+      labels:
+        app.kubernetes.io/instance: test
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: external-dns
+        helm.sh/chart: external-dns-6.19.2
+    spec:
+      affinity:
+        nodeAffinity: null
+        podAffinity: null
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/instance: test
+                  app.kubernetes.io/name: external-dns
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - --metrics-address=:7979
+        - --log-level=info
+        - --log-format=text
+        - --policy=upsert-only
+        - --provider=aws
+        - --registry=txt
+        - --interval=1m
+        - --source=service
+        - --source=ingress
+        - --aws-api-retries=3
+        - --aws-zone-type=
+        - --aws-batch-change-size=1000
+        env:
+        - name: AWS_DEFAULT_REGION
+          value: us-east-1
+        envFrom: null
+        image: docker.io/bitnami/external-dns:0.13.4-debian-11-r14
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 2
+          httpGet:
+            path: /healthz
+            port: http
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        name: external-dns
+        ports:
+        - containerPort: 7979
+          name: http
+        readinessProbe:
+          failureThreshold: 6
+          httpGet:
+            path: /healthz
+            port: http
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        resources:
+          limits: {}
+          requests: {}
+        volumeMounts: null
+      securityContext:
+        fsGroup: 1001
+        runAsUser: 1001
+      serviceAccountName: default
+      volumes: null
+`
+)
+
 func TestHelmChartInflationGeneratorOld(t *testing.T) {
 	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
 	defer th.Reset()
@@ -84,6 +177,64 @@ helmCharts:
 	th.AssertActualEqualsExpected(m, expectedHelm)
 }
 
+func TestHelmChartInflationGeneratorWithOciRepository(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	th.WriteK(th.GetRoot(), `
+helmCharts:
+- name: external-dns
+  repo: oci://registry-1.docker.io/bitnamicharts
+  version: 6.19.2
+  releaseName: test
+  valuesInline:
+    crd:
+      create: false
+    rbac:
+      create: false
+    serviceAccount:
+      create: false
+    service:
+      enabled: false
+
+`)
+
+	m := th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, expectedHelmExternalDNS)
+}
+
+func TestHelmChartInflationGeneratorWithOciRepositoryWithAppendSlash(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	th.WriteK(th.GetRoot(), `
+helmCharts:
+- name: external-dns
+  repo: oci://registry-1.docker.io/bitnamicharts/
+  version: 6.19.2
+  releaseName: test
+  valuesInline:
+    crd:
+      create: false
+    rbac:
+      create: false
+    serviceAccount:
+      create: false
+    service:
+      enabled: false
+
+`)
+
+	m := th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, expectedHelmExternalDNS)
+}
+
 // Last mile helm - show how kustomize puts helm charts into different
 // namespaces with different customizations.
 func TestHelmChartProdVsDev(t *testing.T) {
@@ -416,6 +567,325 @@ metadata:
 `)
 }
 
+// Reference: https://github.com/kubernetes-sigs/kustomize/issues/5163
+func TestHelmChartInflationGeneratorForMultipleChartsDifferentVersion(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	copyValuesFilesTestChartsIntoHarness(t, th)
+
+	th.WriteK(th.GetRoot(), `
+namespace: default
+helmCharts:
+  - name: test-chart
+    releaseName: test
+    version: 1.0.0
+    skipTests: true
+  - name: minecraft
+    repo: https://itzg.github.io/minecraft-server-charts
+    version: 3.1.3
+    releaseName: test-1
+  - name: minecraft
+    repo: https://itzg.github.io/minecraft-server-charts
+    version: 3.1.4
+    releaseName: test-2
+`)
+
+	m := th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    chart: test-1.0.0
+  name: my-deploy
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: test
+  template:
+    spec:
+      containers:
+      - image: test-image:v1.0.0
+        imagePullPolicy: Always
+---
+apiVersion: v1
+data:
+  rcon-password: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-1-minecraft
+    chart: minecraft-3.1.3
+    heritage: Helm
+    release: test-1
+  name: test-1-minecraft
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: test-1-minecraft
+    chart: minecraft-3.1.3
+    heritage: Helm
+    release: test-1
+  name: test-1-minecraft
+  namespace: default
+spec:
+  ports:
+  - name: minecraft
+    port: 25565
+    protocol: TCP
+    targetPort: minecraft
+  selector:
+    app: test-1-minecraft
+  type: ClusterIP
+---
+apiVersion: v1
+data:
+  rcon-password: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-2-minecraft
+    chart: minecraft-3.1.4
+    heritage: Helm
+    release: test-2
+  name: test-2-minecraft
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: test-2-minecraft
+    chart: minecraft-3.1.4
+    heritage: Helm
+    release: test-2
+  name: test-2-minecraft
+  namespace: default
+spec:
+  ports:
+  - name: minecraft
+    port: 25565
+    protocol: TCP
+    targetPort: minecraft
+  selector:
+    app: test-2-minecraft
+  type: ClusterIP
+`)
+}
+
+func TestHelmChartInflationGeneratorForMultipleKubeVersions(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarnessWithTmpRoot(t)
+	defer th.Reset()
+	if err := th.ErrIfNoHelm(); err != nil {
+		t.Skip("skipping: " + err.Error())
+	}
+
+	copyValuesFilesTestChartsIntoHarness(t, th)
+
+	th.WriteK(th.GetRoot(), `
+namespace: default
+helmCharts:
+  - name: minecraft
+    repo: https://itzg.github.io/minecraft-server-charts
+    version: 4.11.0
+    releaseName: test
+    kubeVersion: "1.16"
+    valuesInline:
+      minecraftServer:
+        extraPorts:
+          - name: map
+            containerPort: 8123
+            protocol: TCP
+            service:
+              enabled: false
+            ingress:
+              enabled: true
+`)
+
+	m := th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  rcon-password: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.11.0
+    chart: minecraft-4.11.0
+    heritage: Helm
+    release: test
+  name: test-minecraft-rcon
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.11.0
+    chart: minecraft-4.11.0
+    heritage: Helm
+    release: test
+  name: test-minecraft-curseforge
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.11.0
+    chart: minecraft-4.11.0
+    heritage: Helm
+    release: test
+  name: test-minecraft
+  namespace: default
+spec:
+  ports:
+  - name: minecraft
+    port: 25565
+    protocol: TCP
+    targetPort: minecraft
+  selector:
+    app: test-minecraft
+  type: ClusterIP
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  labels:
+    app: test-minecraft-map
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.11.0
+    chart: minecraft-4.11.0
+    heritage: Helm
+    release: test
+  name: test-minecraft-map
+  namespace: default
+spec:
+  rules: null
+`)
+
+	th.WriteK(th.GetRoot(), `
+namespace: default
+helmCharts:
+  - name: minecraft
+    repo: https://itzg.github.io/minecraft-server-charts
+    version: 4.11.0
+    releaseName: test
+    kubeVersion: "1.27"
+    valuesInline:
+      minecraftServer:
+        extraPorts:
+          - name: map
+            containerPort: 8123
+            protocol: TCP
+            service:
+              enabled: false
+            ingress:
+              enabled: true
+`)
+
+	m = th.Run(th.GetRoot(), th.MakeOptionsPluginsEnabled())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: v1
+data:
+  rcon-password: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.11.0
+    chart: minecraft-4.11.0
+    heritage: Helm
+    release: test
+  name: test-minecraft-rcon
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+data:
+  cf-api-key: Q0hBTkdFTUUh
+kind: Secret
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.11.0
+    chart: minecraft-4.11.0
+    heritage: Helm
+    release: test
+  name: test-minecraft-curseforge
+  namespace: default
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: test-minecraft
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.11.0
+    chart: minecraft-4.11.0
+    heritage: Helm
+    release: test
+  name: test-minecraft
+  namespace: default
+spec:
+  ports:
+  - name: minecraft
+    port: 25565
+    protocol: TCP
+    targetPort: minecraft
+  selector:
+    app: test-minecraft
+  type: ClusterIP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  labels:
+    app: test-minecraft-map
+    app.kubernetes.io/instance: test-minecraft
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/version: 4.11.0
+    chart: minecraft-4.11.0
+    heritage: Helm
+    release: test
+  name: test-minecraft-map
+  namespace: default
+spec:
+  rules: null
+`)
+}
+
 func copyValuesFilesTestChartsIntoHarness(t *testing.T, th *kusttest_test.HarnessEnhanced) {
 	t.Helper()
 

api/krusty/kustomizer.go

@@ -8,11 +8,11 @@ import (
 	"log"
 
 	"sigs.k8s.io/kustomize/api/internal/builtins"
+	fLdr "sigs.k8s.io/kustomize/api/internal/loader"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/internal/target"
 	"sigs.k8s.io/kustomize/api/internal/utils"
 	"sigs.k8s.io/kustomize/api/konfig"
-	fLdr "sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/provenance"
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"

api/krusty/multiplepatch_test.go

@@ -6,8 +6,6 @@ package krusty_test
 import (
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 )
 
@@ -303,20 +301,15 @@ patchesStrategicMerge:
 	m = th.Run("overlay", th.MakeDefaultOptions())
 	th.AssertActualEqualsExpected(m, expected)
 
-	// Technique 4: "patches:" field, one patch file.  Fails.
+	// Technique 4: "patches:" field, one patch file.
 	th.WriteK("overlay", `
 resources:
 - ../base
 patches:
 - path: twoPatchesInOneFile.yaml
 `)
-	err := th.RunWithErr("overlay", th.MakeDefaultOptions())
-	assert.Error(t, err)
-	// This should fail, because the semantics of the `patches` field.
-	// That field allows specific patch targeting to a list of targets,
-	// while the `patchesStrategicMerge` field accepts patches that
-	// implicitly identify their targets via GVKN.
-	assert.Contains(t, err.Error(), "unable to parse SM or JSON patch from ")
+	m = th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, expected)
 }
 
 func TestRemoveEmptyDirWithNullFieldInSmp(t *testing.T) {
@@ -1670,7 +1663,7 @@ spec:
   template:
     spec:
       containers:
-        - image: fluentd:latest 
+        - image: fluentd:latest
           name: fluentd
       serviceAccountName: fluentd-sa
 ---

api/krusty/remoteloader_test.go

@@ -10,13 +10,14 @@ import (
 	"io"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/kustomize/api/internal/loader"
 	"sigs.k8s.io/kustomize/api/krusty"
-	"sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/resmap"
 	kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
@@ -27,6 +28,7 @@ func TestRemoteLoad_LocalProtocol(t *testing.T) {
 		root          string
 		simple        string
 		noSuffix      string
+		hash          string
 		multiBaseDev  string
 		withSubmodule string
 	}
@@ -35,9 +37,10 @@ func TestRemoteLoad_LocalProtocol(t *testing.T) {
 	// root/
 	//   simple.git/			- base with just a pod
 	//   nosuffix/				- same as simple.git/ without the .git suffix
+	//   hash-xx/				- same as simple.git/ with random hash at xx
 	//   multibase.git/			- base with a dev overlay
 	//   with-submodule.git/	- includes `simple` as a submodule
-	//     submodule/			- the submodule referencing `simple
+	//     submodule/			- the submodule referencing `simple`
 	createGitRepos := func(t *testing.T) testRepos {
 		t.Helper()
 
@@ -49,10 +52,16 @@ func TestRemoteLoad_LocalProtocol(t *testing.T) {
 			}
 		}
 		root := t.TempDir()
+
+		hashPath, err := os.MkdirTemp(root, "hash-")
+		require.NoError(t, err)
+		hashDir := filepath.Base(hashPath)
+
 		bash(fmt.Sprintf(`
 set -eux
 
 export ROOT="%s"
+export HASH_DIR="%s"
 export GIT_AUTHOR_EMAIL=nobody@kustomize.io
 export GIT_AUTHOR_NAME=Nobody
 export GIT_COMMITTER_EMAIL=nobody@kustomize.io
@@ -84,19 +93,27 @@ cp -r testdata/remoteload/multibase $ROOT/multibase.git
 	git add .
 	git commit -m "import"
 )
+cp -r testdata/remoteload/with-submodule $ROOT/with-submodule.git # see README
+cp -r $ROOT/simple.git/. $ROOT/$HASH_DIR
 (
-	mkdir $ROOT/with-submodule.git
 	cd $ROOT/with-submodule.git
 	git init --initial-branch=main
-	git submodule add $ROOT/simple.git submodule
+	git add .
 	git commit -m "import"
+	git checkout -b relative-submodule
+	git submodule add ../$HASH_DIR submodule
+	git commit -m "relative submodule"
+	git checkout main
+	git submodule add $ROOT/simple.git submodule
+	git commit -m "submodule"	
 )
-`, root))
+`, root, hashDir))
 		return testRepos{
 			root: root,
 			// The strings below aren't currently used, and more serve as documentation.
 			simple:        "simple.git",
 			noSuffix:      "nosuffix",
+			hash:          hashDir,
 			multiBaseDev:  "multibase.git",
 			withSubmodule: "with-submodule.git",
 		}
@@ -182,6 +199,15 @@ resources:
 `,
 			expected: simpleBuild,
 		},
+		{
+			name: "has relative submodule",
+			kustomization: `
+resources:
+- file://$ROOT/with-submodule.git/submodule?ref=relative-submodule
+`,
+
+			expected: simpleBuild,
+		},
 		{
 			name: "has timeout",
 			kustomization: `
@@ -272,7 +298,7 @@ resources:
 
 			if test.err != "" {
 				require.Error(t, err)
-				require.Contains(t, err.Error(), test.err)
+				require.Regexp(t, test.err, err.Error())
 			} else {
 				require.NoError(t, err)
 				checkYaml(t, m, strings.ReplaceAll(test.expected, "$ROOT", repos.root))

api/krusty/replacementtransformer_test.go

@@ -546,3 +546,71 @@ metadata:
   name: red-dc6gc5btkc
 `)
 }
+
+func TestReplacementTransformerWithSuffixTransformerAndReject(t *testing.T) {
+	th := kusttest_test.MakeEnhancedHarness(t)
+	defer th.Reset()
+
+	th.WriteF("base/app.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: original-name
+spec:
+  template:
+    spec:
+      containers:
+        - image: app1:1.0
+          name: app
+`)
+	th.WriteK("base", `
+resources:
+  - app.yaml
+`)
+	th.WriteK("overlay", `
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+nameSuffix: -dev
+resources:
+  - ../base
+
+configMapGenerator:
+  - name: app-config
+    literals:
+      - name=something-else
+
+replacements:
+  - source:
+      kind: ConfigMap
+      name: app-config
+      fieldPath: data.name
+    targets:
+      - fieldPaths:
+          - spec.template.spec.containers.0.name
+        select:
+          kind: Deployment
+        reject:
+          - name: original-name
+`)
+	m := th.Run("overlay", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: original-name-dev
+spec:
+  template:
+    spec:
+      containers:
+      - image: app1:1.0
+        name: app
+---
+apiVersion: v1
+data:
+  name: something-else
+kind: ConfigMap
+metadata:
+  name: app-config-dev-97544dk6t8
+`)
+}

api/krusty/testdata/remoteload/with-submodule/README.md

@@ -0,0 +1,10 @@
+# submodule
+
+This repo demonstrates kustomize's ability to download git repos 
+with submodules. The following branches contain
+* main: submodule via absolute path
+* relative-submodule: submodule via relative path
+
+For the submodule accessed via a relative path, we include a random hash in the
+submodule name to avoid accessing an unintended directory in the case kustomize
+contains loader bugs (issue #5131).

api/kv/kv_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	ldr "sigs.k8s.io/kustomize/api/loader"
+	ldr "sigs.k8s.io/kustomize/api/pkg/loader"
 	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
@@ -70,14 +70,19 @@ func TestKeyValuesFromLines(t *testing.T) {
 			},
 			expectedErr: false,
 		},
-		// TODO: add negative testcases
+		{
+			desc:          "invalid UTF-8 content",
+			content:       "Invalid UTF8 Content: \x80\x81",
+			expectedPairs: nil,
+			expectedErr:   true,
+		},
 	}
 
 	kvl := makeKvLoader(filesys.MakeFsInMemory())
 	for _, test := range tests {
 		pairs, err := kvl.keyValuesFromLines([]byte(test.content))
 		if test.expectedErr && err == nil {
-			t.Fatalf("%s should not return error", test.desc)
+			t.Fatalf("%s should return error", test.desc)
 		}
 		if !reflect.DeepEqual(pairs, test.expectedPairs) {
 			t.Errorf("%s should succeed, got:%v exptected:%v", test.desc, pairs, test.expectedPairs)

api/pkg/loader/loader.go

@@ -0,0 +1,24 @@
+// Copyright 2023 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package pkg has all the helpers to interact with the api.
+package loader
+
+import (
+	"sigs.k8s.io/kustomize/api/internal/loader"
+	"sigs.k8s.io/kustomize/kyaml/filesys"
+)
+
+// NewFileLoaderAtCwd returns a loader that loads from PWD.
+// A convenience for kustomize edit commands.
+func NewFileLoaderAtCwd(fSys filesys.FileSystem) *loader.FileLoader {
+	return loader.NewLoaderOrDie(
+		loader.RestrictionRootOnly, fSys, filesys.SelfDir)
+}
+
+// NewFileLoaderAtRoot returns a loader that loads from "/".
+// A convenience for tests.
+func NewFileLoaderAtRoot(fSys filesys.FileSystem) *loader.FileLoader {
+	return loader.NewLoaderOrDie(
+		loader.RestrictionRootOnly, fSys, filesys.Separator)
+}

api/resmap/factory_test.go

@@ -9,8 +9,9 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"sigs.k8s.io/kustomize/api/ifc"
+	loader "sigs.k8s.io/kustomize/api/internal/loader"
 	"sigs.k8s.io/kustomize/api/kv"
-	"sigs.k8s.io/kustomize/api/loader"
+	ldrpkg "sigs.k8s.io/kustomize/api/pkg/loader"
 	. "sigs.k8s.io/kustomize/api/resmap"
 	resmaptest_test "sigs.k8s.io/kustomize/api/testutils/resmaptest"
 	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"
@@ -249,7 +250,7 @@ func TestNewResMapFromSecretArgs(t *testing.T) {
 
 	actual, err := rmF.NewResMapFromSecretArgs(
 		kv.NewLoader(
-			loader.NewFileLoaderAtRoot(fSys),
+			ldrpkg.NewFileLoaderAtRoot(fSys),
 			valtest_test.MakeFakeValidator()), secrets)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)

api/resmap/reswrangler.go

@@ -696,8 +696,7 @@ func (m *resWrangler) DeAnchor() (err error) {
 }
 
 // ApplySmPatch applies the patch, and errors on Id collisions.
-func (m *resWrangler) ApplySmPatch(
-	selectedSet *resource.IdSet, patch *resource.Resource) error {
+func (m *resWrangler) ApplySmPatch(selectedSet *resource.IdSet, patch *resource.Resource) error {
 	var list []*resource.Resource
 	for _, res := range m.rList {
 		if selectedSet.Contains(res.CurId()) {

api/resmap/reswrangler_test.go

@@ -822,8 +822,9 @@ func TestAppendAll(t *testing.T) {
 	}
 }
 
-func makeMap1() ResMap {
-	return rmF.FromResource(rf.FromMapAndOption(
+func makeMap1(t *testing.T) ResMap {
+	t.Helper()
+	r, err := rf.FromMapAndOption(
 		map[string]interface{}{
 			"apiVersion": "apps/v1",
 			"kind":       "ConfigMap",
@@ -836,11 +837,16 @@ func makeMap1() ResMap {
 			},
 		}, &types.GeneratorArgs{
 			Behavior: "create",
-		}))
+		})
+	if err != nil {
+		t.Fatalf("expected new intance with an options but got error: %v", err)
+	}
+	return rmF.FromResource(r)
 }
 
-func makeMap2(b types.GenerationBehavior) ResMap {
-	return rmF.FromResource(rf.FromMapAndOption(
+func makeMap2(t *testing.T, b types.GenerationBehavior) ResMap {
+	t.Helper()
+	r, err := rf.FromMapAndOption(
 		map[string]interface{}{
 			"apiVersion": "apps/v1",
 			"kind":       "ConfigMap",
@@ -854,14 +860,19 @@ func makeMap2(b types.GenerationBehavior) ResMap {
 			},
 		}, &types.GeneratorArgs{
 			Behavior: b.String(),
-		}))
+		})
+	if err != nil {
+		t.Fatalf("expected new intance with an options but got error: %v", err)
+	}
+	return rmF.FromResource(r)
 }
 
 func TestAbsorbAll(t *testing.T) {
 	metadata := map[string]interface{}{
 		"name": "cmap",
 	}
-	expected := rmF.FromResource(rf.FromMapAndOption(
+
+	r, err := rf.FromMapAndOption(
 		map[string]interface{}{
 			"apiVersion": "apps/v1",
 			"kind":       "ConfigMap",
@@ -874,24 +885,26 @@ func TestAbsorbAll(t *testing.T) {
 		},
 		&types.GeneratorArgs{
 			Behavior: "create",
-		}))
-	w := makeMap1()
-	assert.NoError(t, w.AbsorbAll(makeMap2(types.BehaviorMerge)))
+		})
+	if err != nil {
+		t.Fatalf("expected new intance with an options but got error: %v", err)
+	}
+	expected := rmF.FromResource(r)
+	w := makeMap1(t)
+	assert.NoError(t, w.AbsorbAll(makeMap2(t, types.BehaviorMerge)))
 	expected.RemoveBuildAnnotations()
 	w.RemoveBuildAnnotations()
 	assert.NoError(t, expected.ErrorIfNotEqualLists(w))
-	w = makeMap1()
+	w = makeMap1(t)
 	assert.NoError(t, w.AbsorbAll(nil))
-	assert.NoError(t, w.ErrorIfNotEqualLists(makeMap1()))
+	assert.NoError(t, w.ErrorIfNotEqualLists(makeMap1(t)))
 
-	w = makeMap1()
-	w2 := makeMap2(types.BehaviorReplace)
+	w = makeMap1(t)
+	w2 := makeMap2(t, types.BehaviorReplace)
 	assert.NoError(t, w.AbsorbAll(w2))
 	w2.RemoveBuildAnnotations()
 	assert.NoError(t, w2.ErrorIfNotEqualLists(w))
-	w = makeMap1()
-	w2 = makeMap2(types.BehaviorUnspecified)
-	err := w.AbsorbAll(w2)
+	err = makeMap1(t).AbsorbAll(makeMap2(t, types.BehaviorUnspecified))
 	assert.Error(t, err)
 	assert.True(
 		t, strings.Contains(err.Error(), "behavior must be merge or replace"))

api/resource/factory.go

@@ -42,7 +42,12 @@ func (rf *Factory) Hasher() ifc.KustHasher {
 
 // FromMap returns a new instance of Resource.
 func (rf *Factory) FromMap(m map[string]interface{}) *Resource {
-	return rf.FromMapAndOption(m, nil)
+	res, err := rf.FromMapAndOption(m, nil)
+	if err != nil {
+		// TODO: return err instead of log.
+		log.Fatalf("failed to create resource from map: %v", err)
+	}
+	return res
 }
 
 // FromMapWithName returns a new instance with the given "original" name.
@@ -52,19 +57,22 @@ func (rf *Factory) FromMapWithName(n string, m map[string]interface{}) *Resource
 
 // FromMapWithNamespaceAndName returns a new instance with the given "original" namespace.
 func (rf *Factory) FromMapWithNamespaceAndName(ns string, n string, m map[string]interface{}) *Resource {
-	r := rf.FromMapAndOption(m, nil)
+	r, err := rf.FromMapAndOption(m, nil)
+	if err != nil {
+		// TODO: return err instead of log.
+		log.Fatalf("failed to create resource from map: %v", err)
+	}
 	return r.setPreviousId(ns, n, r.GetKind())
 }
 
 // FromMapAndOption returns a new instance of Resource with given options.
 func (rf *Factory) FromMapAndOption(
-	m map[string]interface{}, args *types.GeneratorArgs) *Resource {
+	m map[string]interface{}, args *types.GeneratorArgs) (*Resource, error) {
 	n, err := yaml.FromMap(m)
 	if err != nil {
-		// TODO: return err instead of log.
-		log.Fatal(err)
+		return nil, fmt.Errorf("failed to convert map to YAML node: %w", err)
 	}
-	return rf.makeOne(n, args)
+	return rf.makeOne(n, args), nil
 }
 
 // makeOne returns a new instance of Resource.

api/resource/factory_test.go

@@ -9,7 +9,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"sigs.k8s.io/kustomize/api/loader"
+	"sigs.k8s.io/kustomize/api/internal/loader"
 	. "sigs.k8s.io/kustomize/api/resource"
 	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/filesys"

api/testutils/kusttest/harness.go

@@ -7,8 +7,8 @@ import (
 	"path/filepath"
 	"testing"
 
+	"sigs.k8s.io/kustomize/api/internal/konfig/builtinpluginconsts"
 	"sigs.k8s.io/kustomize/api/konfig"
-	"sigs.k8s.io/kustomize/api/konfig/builtinpluginconsts"
 	"sigs.k8s.io/kustomize/api/krusty"
 	"sigs.k8s.io/kustomize/api/resmap"
 	"sigs.k8s.io/kustomize/api/types"

api/testutils/kusttest/harnessenhanced.go

@@ -11,9 +11,9 @@ import (
 	"testing"
 
 	"sigs.k8s.io/kustomize/api/ifc"
+	fLdr "sigs.k8s.io/kustomize/api/internal/loader"
 	pLdr "sigs.k8s.io/kustomize/api/internal/plugins/loader"
 	"sigs.k8s.io/kustomize/api/konfig"
-	fLdr "sigs.k8s.io/kustomize/api/loader"
 	"sigs.k8s.io/kustomize/api/provider"
 	"sigs.k8s.io/kustomize/api/resmap"
 	valtest_test "sigs.k8s.io/kustomize/api/testutils/valtest"

api/testutils/kusttest/ondisk.go

@@ -11,19 +11,27 @@ import (
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
+// Setup sets up a file system on disk and directory that is cleaned after
+// test completion.
+func Setup(t *testing.T) (filesys.FileSystem, filesys.ConfirmedDir) {
+	t.Helper()
+
+	fSys := filesys.MakeFsOnDisk()
+	dir, err := filesys.NewTmpConfirmedDir()
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_ = fSys.RemoveAll(dir.String())
+	})
+	return fSys, dir
+}
+
 // CreateKustDir creates a file system on disk and a new directory
 // that holds a kustomization file with content. The directory is removed on
 // test completion.
 func CreateKustDir(t *testing.T, content string) (filesys.FileSystem, filesys.ConfirmedDir) {
 	t.Helper()
 
-	fSys := filesys.MakeFsOnDisk()
-	tmpDir, err := filesys.NewTmpConfirmedDir()
-	require.NoError(t, err)
+	fSys, tmpDir := Setup(t)
 	require.NoError(t, fSys.WriteFile(filepath.Join(tmpDir.String(), "kustomization.yaml"), []byte(content)))
-
-	t.Cleanup(func() {
-		require.NoError(t, fSys.RemoveAll(tmpDir.String()))
-	})
 	return fSys, tmpDir
 }

api/types/fieldspec.go

@@ -30,6 +30,8 @@ type FieldSpec struct {
 	resid.Gvk          `json:",inline,omitempty" yaml:",inline,omitempty"`
 	Path               string `json:"path,omitempty" yaml:"path,omitempty"`
 	CreateIfNotPresent bool   `json:"create,omitempty" yaml:"create,omitempty"`
+
+	// Note: If any new pointer based members are added, FsSlice.DeepCopy needs to be updated
 }
 
 func (fs FieldSpec) String() string {
@@ -50,6 +52,13 @@ func (s FsSlice) Less(i, j int) bool {
 	return s[i].Gvk.IsLessThan(s[j].Gvk)
 }
 
+// DeepCopy returns a new copy of FsSlice
+func (s FsSlice) DeepCopy() FsSlice {
+	ret := make(FsSlice, len(s))
+	copy(ret, s)
+	return ret
+}
+
 // MergeAll merges the argument into this, returning the result.
 // Items already present are ignored.
 // Items that conflict (primary key matches, but remain data differs)

api/types/fieldspec_test.go

@@ -142,3 +142,27 @@ func TestFsSlice_MergeAll(t *testing.T) {
 		}
 	}
 }
+
+func TestFsSlice_DeepCopy(t *testing.T) {
+	original := make(FsSlice, 2, 4)
+	original[0] = FieldSpec{Path: "a"}
+	original[1] = FieldSpec{Path: "b"}
+
+	copied := original.DeepCopy()
+
+	original, _ = original.MergeOne(FieldSpec{Path: "c"})
+
+	// perform mutations which should not affect original
+	copied.Swap(0, 1)
+	_, _ = copied.MergeOne(FieldSpec{Path: "d"})
+
+	// if DeepCopy does not work, original would be {b,a,d} instead of {a,b,c}
+	expected := FsSlice{
+		{Path: "a"},
+		{Path: "b"},
+		{Path: "c"},
+	}
+	if !reflect.DeepEqual(original, expected) {
+		t.Fatalf("original affected by mutations to copied object:\ngot\t%+v,\nexpected: %+v", original, expected)
+	}
+}

api/types/generatorargs.go

@@ -5,7 +5,7 @@ package types
 
 // GeneratorArgs contains arguments common to ConfigMap and Secret generators.
 type GeneratorArgs struct {
-	// Namespace for the configmap, optional
+	// Namespace for the resource, optional
 	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
 
 	// Name - actually the partial name - of the generated resource.

api/types/helmchartargs.go

@@ -88,6 +88,9 @@ type HelmChart struct {
 	// ApiVersions is the kubernetes apiversions used for Capabilities.APIVersions
 	ApiVersions []string `json:"apiVersions,omitempty" yaml:"apiVersions,omitempty"`
 
+	// KubeVersion is the kubernetes version used by Helm for Capabilities.KubeVersion"
+	KubeVersion string `json:"kubeVersion,omitempty" yaml:"kubeVersion,omitempty"`
+
 	// NameTemplate is for specifying the name template used to name the release.
 	NameTemplate string `json:"nameTemplate,omitempty" yaml:"nameTemplate,omitempty"`
 
@@ -172,6 +175,10 @@ func (h HelmChart) AsHelmArgs(absChartHome string) []string {
 	for _, apiVer := range h.ApiVersions {
 		args = append(args, "--api-versions", apiVer)
 	}
+	if h.KubeVersion != "" {
+		args = append(args, "--kube-version", h.KubeVersion)
+	}
+
 	if h.IncludeCRDs {
 		args = append(args, "--include-crds")
 	}

api/types/helmchartargs_test.go

@@ -17,6 +17,7 @@ func TestAsHelmArgs(t *testing.T) {
 			Version:               "1.0.0",
 			Repo:                  "https://helm.releases.hashicorp.com",
 			ApiVersions:           []string{"foo", "bar"},
+			KubeVersion:           "1.27",
 			NameTemplate:          "template",
 			SkipTests:             true,
 			IncludeCRDs:           true,
@@ -33,6 +34,7 @@ func TestAsHelmArgs(t *testing.T) {
 				"-f", "values",
 				"-f", "values1", "-f", "values2",
 				"--api-versions", "foo", "--api-versions", "bar",
+				"--kube-version", "1.27",
 				"--include-crds",
 				"--skip-tests",
 				"--no-hooks"})

api/types/kustomization.go

@@ -188,6 +188,7 @@ const (
 	deprecatedPatchesJson6902Message           = "# Warning: 'patchesJson6902' is deprecated. Please use 'patches' instead." + " " + deprecatedWarningToRunEditFix
 	deprecatedPatchesStrategicMergeMessage     = "# Warning: 'patchesStrategicMerge' is deprecated. Please use 'patches' instead." + " " + deprecatedWarningToRunEditFix
 	deprecatedVarsMessage                      = "# Warning: 'vars' is deprecated. Please use 'replacements' instead." + " " + deprecatedWarningToRunEditFixExperimential
+	deprecatedCommonLabelsWarningMessage       = "# Warning: 'commonLabels' is deprecated. Please use 'labels' instead." + " " + deprecatedWarningToRunEditFix
 )
 
 // CheckDeprecatedFields check deprecated field is used or not.
@@ -196,6 +197,9 @@ func (k *Kustomization) CheckDeprecatedFields() *[]string {
 	if k.Bases != nil {
 		warningMessages = append(warningMessages, deprecatedBaseWarningMessage)
 	}
+	if k.CommonLabels != nil {
+		warningMessages = append(warningMessages, deprecatedCommonLabelsWarningMessage)
+	}
 	if k.ImageTags != nil {
 		warningMessages = append(warningMessages, deprecatedImageTagsWarningMessage)
 	}

api/types/kustomization_test.go

@@ -29,6 +29,13 @@ func TestKustomization_CheckDeprecatedFields(t *testing.T) {
 			},
 			want: &[]string{deprecatedBaseWarningMessage},
 		},
+		{
+			name: "using_CommonLabels",
+			k: Kustomization{
+				CommonLabels: map[string]string{},
+			},
+			want: &[]string{deprecatedCommonLabelsWarningMessage},
+		},
 		{
 			name: "using_ImageTags",
 			k: Kustomization{
@@ -61,6 +68,7 @@ func TestKustomization_CheckDeprecatedFields(t *testing.T) {
 			name: "usingAll",
 			k: Kustomization{
 				Bases:                 []string{"base"},
+				CommonLabels:          map[string]string{},
 				ImageTags:             []Image{},
 				PatchesJson6902:       []Patch{},
 				PatchesStrategicMerge: []PatchStrategicMerge{},
@@ -68,6 +76,7 @@ func TestKustomization_CheckDeprecatedFields(t *testing.T) {
 			},
 			want: &[]string{
 				deprecatedBaseWarningMessage,
+				deprecatedCommonLabelsWarningMessage,
 				deprecatedImageTagsWarningMessage,
 				deprecatedPatchesJson6902Message,
 				deprecatedPatchesStrategicMergeMessage,

api/types/pluginconfig.go

@@ -4,8 +4,10 @@
 package types
 
 type HelmConfig struct {
-	Enabled bool
-	Command string
+	Enabled     bool
+	Command     string
+	ApiVersions []string
+	KubeVersion string
 }
 
 // PluginConfig holds plugin configuration.

api/types/var_test.go

@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
-	"gopkg.in/yaml.v2"
 	"sigs.k8s.io/kustomize/kyaml/resid"
+	yaml "sigs.k8s.io/yaml/goyaml.v2"
 )
 
 func TestGVK(t *testing.T) {

cmd/config/go.mod

@@ -7,7 +7,7 @@ require (
 	github.com/spf13/cobra v1.7.0
 	github.com/stretchr/testify v1.8.1
 	gopkg.in/inf.v0 v0.9.1
-	sigs.k8s.io/kustomize/kyaml v0.14.3
+	sigs.k8s.io/kustomize/kyaml v0.16.0
 )
 
 require (
@@ -28,10 +28,9 @@ require (
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
-	golang.org/x/sys v0.8.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
 	google.golang.org/protobuf v1.30.0 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961 // indirect
-	sigs.k8s.io/yaml v1.3.0 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )

cmd/config/go.sum

@@ -64,8 +64,8 @@ github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee331t6JAXeK2bcyhLOOc=
 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o=
 golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
@@ -79,15 +79,13 @@ gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961 h1:pqRVJGQJz6oeZby8qmPKXYIBjyrcv7EHCe/33UkZMYA=
 k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961/go.mod h1:l8HTwL5fqnlns4jOveW1L75eo7R9KFHxiE0bsPGy428=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
-sigs.k8s.io/kustomize/kyaml v0.14.3 h1:WpabVAKZe2YEp/irTSHwD6bfjwZnTtSDewd2BVJGMZs=
-sigs.k8s.io/kustomize/kyaml v0.14.3/go.mod h1:npvh9epWysfQ689Rtt/U+dpOJDTBn8kUnF1O6VzvmZA=
-sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
-sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
+sigs.k8s.io/kustomize/kyaml v0.16.0 h1:6J33uKSoATlKZH16unr2XOhDI+otoe2sR3M8PDzW3K0=
+sigs.k8s.io/kustomize/kyaml v0.16.0/go.mod h1:xOK/7i+vmE14N2FdFyugIshB8eF6ALpy7jI87Q2nRh4=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=

cmd/config/internal/commands/e2e/e2econtainerconfig/go.mod

@@ -22,13 +22,12 @@ require (
 	github.com/spf13/cobra v1.7.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	golang.org/x/sys v0.8.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
 	google.golang.org/protobuf v1.30.0 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961 // indirect
 	k8s.io/utils v0.0.0-20230505201702-9f6742963106 // indirect
-	sigs.k8s.io/yaml v1.3.0 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )
 
 replace sigs.k8s.io/kustomize/kyaml => ../../../../../../kyaml

cmd/config/internal/commands/e2e/e2econtainerconfig/go.sum

@@ -58,8 +58,8 @@ github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKs
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
@@ -68,8 +68,6 @@ google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqw
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -78,5 +76,5 @@ k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961/go.mod h1:l8HTwL5fqnlns4j
 k8s.io/utils v0.0.0-20230505201702-9f6742963106 h1:EObNQ3TW2D+WptiYXlApGNLVy0zm/JIBVY9i+M4wpAU=
 k8s.io/utils v0.0.0-20230505201702-9f6742963106/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
-sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
-sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=

cmd/config/internal/commands/e2e/e2econtainerenvgenerator/Dockerfile

@@ -0,0 +1,18 @@
+# Copyright 2019 The Kubernetes Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+FROM golang:1.20-bullseye
+ENV CGO_ENABLED=0
+WORKDIR /go/src/
+
+# download modules
+# COPY go.mod go.mod
+# COPY go.sum go.sum
+# RUN go mod download
+
+COPY . .
+RUN go build -v -o /usr/local/bin/function ./cmd/config/internal/commands/e2e/e2econtainerenvgenerator
+
+FROM alpine:latest
+COPY --from=0 /usr/local/bin/function /usr/local/bin/function
+CMD ["function"]

cmd/config/internal/commands/e2e/e2econtainerenvgenerator/Makefile

@@ -0,0 +1,9 @@
+# Copyright 2019 The Kubernetes Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+include ../../../../../../Makefile-modules.mk
+
+.PHONY: image
+image:
+	docker build . -t gcr.io/kustomize-functions/e2econtainerenvgenerator
+	docker push gcr.io/kustomize-functions/e2econtainerenvgenerator

cmd/config/internal/commands/e2e/e2econtainerenvgenerator/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package main contains a function to be used for e2e testing.
+// See https://github.com/kubernetes-sigs/kustomize/blob/master/cmd/config/docs/api-conventions/functions-spec.md
+package main

cmd/config/internal/commands/e2e/e2econtainerenvgenerator/go.mod

@@ -0,0 +1,34 @@
+module sigs.k8s.io/kustomize/cmd/config/internal/commands/e2e/e2econtainerenvgenerator
+
+go 1.20
+
+require sigs.k8s.io/kustomize/kyaml v0.14.2
+
+require (
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/go-errors/errors v1.4.2 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
+	github.com/spf13/cobra v1.7.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/xlab/treeprint v1.2.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961 // indirect
+	k8s.io/utils v0.0.0-20230505201702-9f6742963106 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
+)
+
+replace sigs.k8s.io/kustomize/kyaml => ../../../../../../kyaml

cmd/config/internal/commands/e2e/e2econtainerenvgenerator/go.sum

@@ -0,0 +1,82 @@
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
+github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
+github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
+github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
+github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
+github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
+github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
+github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
+github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
+google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961 h1:pqRVJGQJz6oeZby8qmPKXYIBjyrcv7EHCe/33UkZMYA=
+k8s.io/kube-openapi v0.0.0-20230601164746-7562a1006961/go.mod h1:l8HTwL5fqnlns4jOveW1L75eo7R9KFHxiE0bsPGy428=
+k8s.io/utils v0.0.0-20230505201702-9f6742963106 h1:EObNQ3TW2D+WptiYXlApGNLVy0zm/JIBVY9i+M4wpAU=
+k8s.io/utils v0.0.0-20230505201702-9f6742963106/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
+sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
+sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=

cmd/config/internal/commands/e2e/e2econtainerenvgenerator/main.go

@@ -0,0 +1,38 @@
+// Copyright 2019 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"sigs.k8s.io/kustomize/kyaml/fn/framework"
+	"sigs.k8s.io/kustomize/kyaml/fn/framework/command"
+	"sigs.k8s.io/kustomize/kyaml/kio"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func main() {
+	api := new(struct {
+		Template string `json:"template" yaml:"template"`
+	})
+	// create the template
+	templateFn := func(items []*yaml.RNode) ([]*yaml.RNode, error) {
+		generated := []*yaml.RNode{}
+		for range items {
+			templateResult, err := yaml.Parse(fmt.Sprintf(api.Template, os.Getenv("TESTTEMPLATE")))
+			if err != nil {
+				return nil, fmt.Errorf("failed to parse: %w", err)
+			}
+			generated = append(generated, templateResult)
+		}
+		return generated, nil
+	}
+	p := framework.SimpleProcessor{Config: api, Filter: kio.FilterFunc(templateFn)}
+	cmd := command.Build(p, command.StandaloneDisabled, false)
+	command.AddGenerateDockerfile(cmd)
+	if err := cmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}

cmd/config/internal/commands/e2e/e2econtainermountbind/Dockerfile

@@ -0,0 +1,18 @@
+# Copyright 2019 The Kubernetes Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+FROM golang:1.20-bullseye
+ENV CGO_ENABLED=0
+WORKDIR /go/src/
+
+# download modules
+# COPY go.mod go.mod
+# COPY go.sum go.sum
+# RUN go mod download
+
+COPY . .
+RUN go build -v -o /usr/local/bin/function ./cmd/config/internal/commands/e2e/e2econtainermountbind
+
+FROM alpine:latest
+COPY --from=0 /usr/local/bin/function /usr/local/bin/function
+CMD ["function"]